DPA case 07101-22-2023-7_34 – Complaint Upheld (Slovenia, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Slovenia's data protection authority upheld a complaint against a company for failing to respond on time to a visitor's request for data access and deletion. The company did eventually respond, but the delay was significant, emphasizing the need for businesses to act promptly on such requests to avoid complaints.
What happened
A visitor's requests for access to and deletion of their personal data were not answered in a timely manner by the company.
Who was affected
The visitor who sought to access and delete their personal data was affected.
What the authority found
The authority ruled that the company did not comply with the legal deadlines for responding to the visitor's requests.
Why this matters
This ruling stresses the importance of timely responses to data requests, reminding companies that delays can lead to upheld complaints and potential scrutiny.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 31 August 2023, the controller sent to a data subject some marketing communications. On the same day, the data subject exercised his right to access as well as deletion, to which the controller did not reply. Thus, on 16 October 2023, the data subject lodged a complaint with the DPA. On 18 October 2023, the DPA requested the controller to comply with the data subject’s access request. The controller replied on 3 November 2023, indicating that it had sent the data subject a reply to his request on the same day and that it had deleted the data subject’s data already on 31 August 2023. Subsequently, on 6 November 2023, the DPA informed the data subject that the controller had complied with his request and had fulfilled its obligations under Articles 12 and 15 GDPR and asked whether they wanted to proceed with the complaint. The data subject replied that the controller did apologise for the late reply but that the apology did not change the fact that it had missed the legal deadline. Moreover, the data subject noted that the controller stated in its reply that the data subject had signed up for the notification himself on 19 June 2015. In this respect, the data subject pointed out that, over the years, there had been a change in data protection legislation and that the controller should have obtained his consent again. Therefore, the data subject wanted to continue with the complaint. Noting that the data subject’s access request fell within the scope of Article 15 GDPR, the DPA acknowledged that the deadline for the controller to reply is one month after receipt of the request. This time limit may be extended by up to two additional months if necessary after informing the data subject, as provided by Article 12(3) GDPR. Thus, the DPA noted that at the time of the complaint submission on 16 October 2023, the controller had not yet decided on the data subject's request for access to personal data on 31 August 2023. As the one-month time limit had already expired by
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 07101-22-2023-7_34 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 07101-22-2023-7_34 - Slovenia (2024). Retrieved from cookiefines.eu
Last updated: