National Police – Violation Found (Slovenia, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Slovenia's National Police received a request to delete a woman's information from their website and from media outlets. They initially refused, but later removed the data after the woman filed a complaint. This case highlights the importance of responding promptly to deletion requests under GDPR.
What happened
The National Police failed to properly inform media outlets about a woman's request to delete her personal information from their website.
Who was affected
The woman whose disappearance was reported and whose personal information was published online.
What the authority found
The Slovenian Data Protection Authority found that the National Police did not adequately inform media outlets about the deletion request, violating the right to be forgotten under GDPR.
Why this matters
This ruling emphasizes that companies must take reasonable steps to notify others when a person requests their data be deleted. It serves as a reminder for all organizations to have clear processes for handling such requests.
GDPR Articles Cited
National Law Articles
Entities Involved
On 3 April 2023, the applicant requested the local Police Station (the controller) to delete from its website the information concerning her disappearance, as well as from the websites of the media outlets that had picked up the news from the police website. In a reply dated 6 April 2023, the controller explained that her requests could not be granted because they were not responsible for the content and its deletion from the other online portals. Thus, the applicant filed a complaint to the Slovenian DPA against the controller, and the DPA then began its proceedings by conducting two calls with the controller. The controller confirmed to the DPA that it had removed the applicant's data from its website since its publication was no longer necessary for the purpose of the search for this person. It further explained to have ensured compliance, after the proceedings started, by also communicating to all media outlets that still had news of the applicant's disappearance published online that the applicant had requested the deletion of her personal data. In the notification, the controller had explained to the media outlets that this was a submission of an erasure request, which they had to comply with in accordance with the GDPR. The Slovenian DPA held that the controller violated Article 17(2) GDPR, which regulates the right to be forgotten. In accordance with this provision, upon receiving a deletion request, the controller should have taken reasonable steps to inform the controllers to whom the applicant's personal data had been forwarded that the applicant requested the deletion of her personal data. In the present case, it was clear that the applicant wished to have her information removed as soon as possible from the internet. Thus, the controller should have complied with Article 17(2) GDPR by sending a notification to every media outlet that published the missing person's details stating that the applicant had requested erasure of the information. Hence, the
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for National Police in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. National Police - Slovenia (2023). Retrieved from cookiefines.eu
Last updated: