DPA case 0603-47/2023/5 – Violation Found (Slovenia, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Slovenian Data Protection Authority found that a company conducted excessive video surveillance without proper notice to employees. This ruling is crucial as it underscores the need for businesses to respect employee privacy and comply with surveillance regulations.
What happened
A company was found to have conducted excessive video surveillance at its workplace without appropriate notifications.
Who was affected
Employees working at the company who were subjected to the video surveillance.
What the authority found
The authority determined that the company did not meet the legal requirements for conducting video surveillance.
Why this matters
This case highlights the importance of balancing security measures with employee privacy rights, urging companies to implement proper notification practices.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA decided to bring legal proceedings against a legal entity, the controller, which carried out video surveillance at working premises. The controller claimed they processed data on the basis of legitimate interest as per Article 6(1)(f) GDPR and [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Article 78(1)] [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 of the Slovenian Personal Data Protection Act] (hereinafter referred to as ‘ZVOP-2’). The latter provision allows for video surveillance under specific circumstances, such as safety reasons or protection of business secret which must be specified. In this case, the controller conducted the video surveillance without publishing a notice containing all the information referred to in [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Article 76(4) ZVOP-2,] as the published notice contained only a picture of the camera, the word ‘video surveillance’ and a contact telephone number. According to [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Article 76(5) ZVOP-2,] the controller also had an option to publish this information on its website instead of publishing the notice pursuant to [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Article 76(4) ZVOP-2], yet he opted not to do so. Firstly, the DPA noted that carrying out a video surveillance in working premises of such an excessive part of the space is incompatible with the purposes listed in [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Article 78(1) ZVOP-2]. The DPA observed that it was unnecessary for the controller to conduct such surveillance for security reasons or protection of business secrets. In working premises of this type, these purposes can be achieved with milder and more effective means than video surveillance. As a result, the DPA considered this case an invasive intrusion into the privacy of employees. Even though the controller has legitimate interest for video surveillance of premises of
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0603-47/2023/5 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0603-47/2023/5 - Slovenia (2023). Retrieved from cookiefines.eu
Last updated: