DPA case 0602-11/2024/9 – Complaint Upheld (Slovenia, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A mother requested the deletion of her and her daughter's personal data from a service provider, but the provider initially failed to delete the daughter's data. This case is significant because it shows that companies must act quickly on deletion requests and ensure they verify relationships properly. It highlights the importance of respecting users' rights to their data.
What happened
A data controller did not delete a daughter's personal data after a request from her mother, leading to a complaint.
Who was affected
The mother and her daughter, both users of the service whose data was not fully deleted as requested.
What the authority found
The DPA upheld the complaint, finding that the data controller violated GDPR by not responding to the deletion request in a timely manner, although the issue was later resolved.
Why this matters
This case emphasizes the need for companies to have clear procedures for handling data deletion requests. It highlights the importance of respecting users' rights and verifying relationships when processing such requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Archived or cached source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject and her daughter were users (members) of service provided by a data controller. The data subject requested a data controller to erase the personal data concerning her as well as personal data of her daughter. In an e-mail response, the controller confirmed they deleted the data. Nonetheless, it turned out daughter’s data was still processed. The data subject lodged a complaint with the Slovenian DPA (IP). Within the examination proceedings, the controller explained they deleted data subject’s data according to his request. However, the controller had no data confirming the kinship between the data subject and his daughter. Because of that, the daughter’s data was not initially deleted. However, during the examination proceedings the controller deleted the daughter’s data. The DPA found the controller violated Article 12 GDPR and Article 17 GDPR. The controller did not answer the data subject’s request within the time framework of Article 12(3) GDPR. Nevertheless, during the proceedings before the DPA, the controller deleted the data. Therefore, the violation was remedied and the DPA decided not make use of other corrective powers.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0602-11/2024/9 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0602-11/2024/9 - Slovenia (2024). Retrieved from cookiefines.eu
Last updated: