DPA case 0602-44/2025/6 – Dismissed (Slovenia, 2025)

The data subject, after terminating a membership contract with the controller [note: presumably a gym], requested the deletion of his personal data, exercising his right to be forgotten under Article 17 GDPR. The controller rejected the request, on the grounds that it had a legitimate interest in keeping his name, surname, and birth date - just enough to prevent him from reentering a membership contract with the controller. In fact the data subject was banned from the activity of the controller for wrongful behaviour. The controller, at the verbal request of the data subject, had already deleted all of his data except for those strictly necessary for the enforcement of the ban. The controller invoked legitimate interest under Article 6(1)(f) GDPR to reject the data subject’s request, as the interest is enforcing the ban and keeping employees and other clients safe. The data subject argued that he had no interest in reentering a contract, which the controller proved wrong, as the data subject had recently entered the premises of the controller’s activity to ask to enter a new membership contract. The DPA dismissed the complaint and held that indeed there was legitimate interest in keeping the data subject’s data. It performed the following three-step legitimate interest test: 1. Does a legitimate interest exists? Yes, as it is aimed at ensuring safety and protecting employees and clients 2. Is the processing is necessary to achieve the aim? Yes, processing entails the minimum amount of data necessary for the achievement of the aim 3. Does the legitimate interest outweigh the right of the data subject? Yes, especially in light of the limited scope of the processing and the nature of the ban against the data subject. Following this, the DPA rejected the data subject’s complaint.