DPA case 0600-3/2024/7 – Complaint Upheld (Slovenia, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A complaint was upheld against a company for not properly responding to a person's request for information about their personal data. This matters because it highlights the importance of companies being transparent and responsive to users' requests about their data.
What happened
The company failed to adequately respond to a person's access request regarding their personal data used in court documents.
Who was affected
The person whose data was used in court proceedings and who requested information about it.
What the authority found
The authority found that the company did not properly fulfill its obligation to respond to the person's data access request.
Why this matters
This case emphasizes that companies must be diligent in handling access requests from individuals. It serves as a reminder for businesses to improve their processes for responding to such inquiries.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In 2022, the controller transmitted some personal data of the data subject to the Court of Maribor in order to start a credit recovery proceeding. More specifically, the controller provided the Court with duplicates of payment reminders sent to the data subject. After that, the data subject sent an access request to the controller. They wanted to know, among others, the source of the address stated in the documents provided to the Court. The controller informed the data subject that their access request had been answered by post. The data subject argued they have not received the letter and asked for the receipt of the registered mail. On 9 October 2023, the controller sent the information requested by the data subject by email. The controller argued that the source of the address was a termination letter for a supplementary health insurance contract signed by the data subject. On 16 January 2024, the data subject filed a complaint with the DPA. First of all, the data subject complained their access request had not been replied properly as it was incomplete and was sent by post. Secondly, the data subject argued they had never given that address to the controller. They pointed out that they had never lived at that address and that a landfill could be found at this address. Moreover, the data subject believed the controller had counterfeited the documents it provided to the Court of Maribor as the date stated in the documents is prior to the day in which the controller received the alleged update about their address. The controller noted that the contested address was registered it their Central Register of Clients (CRS) system. It reiterated that the address was modified according to the information contained in a letter the data subject sent to their insurance company to terminate their supplementary health insurance contract. As for the falsification allegations, the controller justified the discrepancy in the date of the document transmitted to the court and t
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0600-3/2024/7 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0600-3/2024/7 - Slovenia (2024). Retrieved from cookiefines.eu
Last updated: