DPA case 0600-10/2024/2 – Dismissed (Slovenia, 2024)

On 5 March 2024 a data subject lodged a complaint with the DPA against a website owner (‘controller’) who published an article in which they disclosed the data subject’s personal data. The personal data disclosed included the data subject’s religious beliefs. In addition to that, the controller also published the applicant’s personal data in the newsletter and refused to withdraw this publication despite the data subject’s request for erasure. This was justified by the freedom of speech of the press. The data subject claimed that they did not consent to this data processing neither was provided a prior notice concerning the disclosure. The DPA rejected the data subject’s claim. As an introduction, the DPA recalled Article 39(1) of the Constitute of the Republic of Slovenia which guarantees freedom of thought, speech and public speaking of the press and other forms of public information and expression. Like the right to the protection of personal data under Article 38 of the Constitution of the Republic of Slovenia, the right to freedom of expression is not unlimited. The DPA confirmed that the controller is a media broadcaster under the Slovenian Media Act. Article 6 Media Act provides that the activities of the media shall be based on freedom of expression as stipulated by the Constitution. According to the DPA, the publication in question is clearly a reflection of that right. Additionally, freedom of expression shall be ensured also in the exercise of rights of data subjects in the context of personal data processed under Article 73 of the Slovenian Data Protection Law (‘ZVOP 2’). In particular, the determination of the right to erasure Article 17 GDPR in cases where personal data are processed in the exercise of the freedom of thought, speech and public expression of the press is not an administrative matter. In fact, according to the DPA, this case shall be dealt with by courts. Therefore, the DPA decided to reject the claim as it is not an administrat