DPA case 0609-20/2024/6 – Complaint Upheld (Slovenia, 2024)

The data subject filed a complaint against a legal entity (the controller) for forwarding and disclosure of personal data of borrowers (‘data subjects’) to their employers. The data subject's identification, financial and economic data was processed due to a security failure of the responsible person - a director of the risk management unit (‘director’). The DPA held that the controller did not meet the conditions for the lawfulness of the processing set out in Article 6(1) GDPR. As the data subjects did no consent to the sharing of their personal data with their employers, the responsible person of the employer violated [https://pisrs.si/pregledPredpisa?id=ZAKO7959 Article 96(1)(1) of the Slovenian Data Protection Law ('ZVOP-2')] for breaching the fundamental principles of data processing. Additionally, the director failed to uphold security measures which led to the sharing of borrowers' data with their employers. The failure to implement appropriate technical and organizational measures to ensure the security of borrowers' personal data constitutes an infringement of the controller's obligation under Article 32 GDPR. Because the infringement occurred within the scope of the director's business activities and on behalf of the legal entity they represented, according [https://pisrs.si/pregledPredpisa?id=ZAKO7959 Article 96(1) ZVOP-2], the liability should be assigned to the responsible individual who committed the offense. As a result, the DPA issued a warning to both the director and its employer and ordered them to pay a court fee of €30.