- Enforcing jurisdiction
- Slovenia · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
DPA case 0609-6/2024/7 – Complaint Upheld (Slovenia, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A responsible person at a company improperly handled personal data of two former employees by forwarding their emails to herself. The DPA found this action violated data protection laws, emphasizing that personal data must be processed lawfully. This case serves as a reminder for companies to ensure their employees follow data protection rules.
What happened
A responsible person unlawfully processed personal data of two individuals by redirecting their emails to her own account.
Who was affected
Two individuals whose personal data was improperly handled by a responsible person at their former company.
What the authority found
The DPA determined that the responsible person violated data protection laws by processing personal data without a legal basis.
Why this matters
This ruling highlights the need for companies to enforce strict data protection policies and hold employees accountable for violations.
Entities Involved
Source checks
Secondary-source text retrieved.
Review needed — 18 October 2026.
Processing notes: articles corrected, national law identified, amount discrepancy, entity split needed.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A responsible person, while employed at a certain company, unlawfully processed the personal data of two individuals. This included their e-mail addresses and the traffic data of the e-mails sent to those addresses during a specified period. Despite the termination of the individuals' employment, the responsible person continued to process their personal data, directing e-mails sent to their addresses to her own e-mail address without proper legal basis or individual consent. The DPA held that the responsible person is found in violation of [https://zakonodaja.com/zakon/zvop-1/8-clen-splosna-opredelitev Article 8(1) of the the Slovenian Data Protection Law ('ZVOP-1')] according to which the personal data may only be processed if so provided by law or if the processing is subject to the consent of the data subject. Importantly, these offenses were committed within the scope of the responsible person's business activities and on behalf of the legal entity she represented. According [https://zakonodaja.com/zakon/zvop-1/91-clen-splosne-krsitve-dolocb-tega-zakona Article 91(1)(2) ZVOP-1], such responsible personal must also be held liable for offences committed. The DPA decided that the legal entity is also held liable for the same breach of [https://zakonodaja.com/zakon/zvop-1/8-clen-splosna-opredelitev Article 8(1) of the Slovenian Data Protection Law] as the offence was committed within the scope of its business activities and on its behalf. As a result, the DPA imposed a fine of €300 to the responsible person of the legal entity and another fine of €6,255 to the legal entity.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0609-6/2024/7 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0609-6/2024/7 - Slovenia (2024). Retrieved from cookiefines.eu
Last updated: