- Enforcing jurisdiction
- Slovenia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 07101-22/2023/7 – Dismissed (Slovenia, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A complaint against a company was dismissed by Slovenia's data protection authority because the company eventually responded to a visitor's request for data access, even though it missed the legal deadline. This case highlights the importance of timely responses to data requests, but since no violation was found, it serves as a reminder for companies to improve their compliance processes.
What happened
A visitor's request for data access was initially ignored by the company, leading to a complaint.
Who was affected
The visitor who requested access to their personal data held by the company was affected.
What the authority found
The authority found that the company complied with the request after the deadline but did not violate the law since it eventually responded.
Why this matters
This case shows that companies can avoid penalties by eventually complying with data requests, but they should strive to meet deadlines to maintain trust and compliance.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 31 August 2023 the data subject received a marketing message. As he was curious to know how the controller obtained his data, he sent him a data access request, to which the controller did not reply. Therefore, the data subject filed a complaint with the Slovenian DPA. On 18 October 2023, the controller was requested by the DPA to take a written decision on the applicant's request in accordance with Article 12 GDPR and Article 15 GDPR. On 3 November 2023, the data controller sent an email to the DPA, indicating that they responded to the request for access to personal data and removed the data subject from the customer database. On 8 November 2023, the data subject informed that he received a response in which the controller apologized for the delayed response. However, the apology did not change the fact that the controller missed the legally prescribed deadline, thereby violating the law and committing an offense for which a fine is prescribed. The controller stated the data subject had voluntarily subscribed to receive notifications on 19 June 2015. In connection with this, the applicant pointed out that there were changes in data protection legislation in recent years, and controllers were required to re-obtain consent for further use or delete data. Therefore, the data subject’s claimed that retaining the data for 8 years longer and starting using the same data after a period of 8 years was unlawful and unsolicited marketing communication. The data subject insisted on reporting the violations, believing that the controller stored and used his data without a legal basis. The DPA acknowledged that the controller complied with the data subject’s request after the expiration of a 1-month deadline. However, the controller remedied this breach by a response to the data subject based on the DPA’s request of 18 October 2023. As a result, the DPA did not find a violation of unlawful storage of data lacking a basis according to Article 6(1) GDPR. Regarding the a
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 07101-22/2023/7 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 07101-22/2023/7 - Slovenia (2024). Retrieved from cookiefines.eu
Last updated: