DPA case 0600-10/2024/2 – Dismissed (Slovenia, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A website owner published a person's personal data, including their religious beliefs, and refused to remove it despite a request. The data protection authority dismissed the complaint, citing freedom of expression. This case illustrates the balance between personal privacy and freedom of the press.
What happened
The website owner published a person's personal data and denied a request for its removal.
Who was affected
The person whose religious beliefs and personal data were published online.
What the authority found
The Slovenian DPA rejected the complaint, stating that the publication fell under freedom of expression rights.
Why this matters
This ruling emphasizes the tension between protecting personal data and upholding freedom of the press. It serves as a reminder for media outlets to consider privacy rights when publishing sensitive information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 5 March 2024 a data subject lodged a complaint with the DPA against a website owner (‘controller’) who published an article in which they disclosed the data subject’s personal data. The personal data disclosed included the data subject’s religious beliefs. In addition to that, the controller also published the applicant’s personal data in the newsletter and refused to withdraw this publication despite the data subject’s request for erasure. This was justified by the freedom of speech of the press. The data subject claimed that they did not consent to this data processing neither was provided a prior notice concerning the disclosure. The DPA rejected the data subject’s claim. As an introduction, the DPA recalled Article 39(1) of the Constitute of the Republic of Slovenia which guarantees freedom of thought, speech and public speaking of the press and other forms of public information and expression. Like the right to the protection of personal data under Article 38 of the Constitution of the Republic of Slovenia, the right to freedom of expression is not unlimited. The DPA confirmed that the controller is a media broadcaster under the Slovenian Media Act. Article 6 Media Act provides that the activities of the media shall be based on freedom of expression as stipulated by the Constitution. According to the DPA, the publication in question is clearly a reflection of that right. Additionally, freedom of expression shall be ensured also in the exercise of rights of data subjects in the context of personal data processed under Article 73 of the Slovenian Data Protection Law (‘ZVOP 2’). In particular, the determination of the right to erasure Article 17 GDPR in cases where personal data are processed in the exercise of the freedom of thought, speech and public expression of the press is not an administrative matter. In fact, according to the DPA, this case shall be dealt with by courts. Therefore, the DPA decided to reject the claim as it is not an administrat
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0600-10/2024/2 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0600-10/2024/2 - Slovenia (2024). Retrieved from cookiefines.eu
Last updated: