DPA case 0600-43/2025/9 – Complaint Upheld (Slovenia, 2025)

The data subject used to be a member of an association, the controller, until her membership expired. The data subject lodged a complaint to the DPA arguing that the controller processed her personal data unlawfully. She claimed that the controller kept sending her electronic newsletters and commercial communications to her email address after her membership had been terminated, despite her explicit objection. She also complaint that the emails that she sent to the controller were forwarded to all other members. The controller claimed that the emails the data subject received were not of commercial nature but emails sent by other members to the association’s official mail address. According to the controller, the data subject was included in the mailing list due to her role in the association. First, the DPA found that the emails she received were not messages of a commercial nature or e-newsletters, but rather messages sent by other members to the controller that were being forwarded to the data subject as well. Second, it found that the controller kept processing the data subject’s email address after the expiry of her membership, by including it in the list of recipients, despite not having an adequate legal basis for processing it. The DPA held that the controller violated Article 5(1)(a) GDPR and Article 6(1) GDPR. Third, the DPA took into consideration that the controller had removed the email address of the data subject from the list of recipients before the issuing of this decision. Therefore, it decided not to order further measures.