AJPES (Agency of the Republic of Slovenia for Public Legal Records and Related Services) – Complaint Upheld (Slovenia, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
AJPES, the Agency of the Republic of Slovenia, published a person's home address online without a legal reason. The individual asked for their address to be removed, but AJPES denied the request. This case highlights the importance of understanding when personal information can be shared publicly.
What happened
AJPES made a person's home address publicly available on the Slovenian Business Register without proper legal grounds.
Who was affected
The individual whose home address was published online by AJPES.
What the authority found
The Slovenian DPA found that AJPES had to publish the person's country of residence but not their full address, which was not required by law.
Why this matters
This ruling emphasizes that organizations must be careful about what personal data they disclose. It serves as a reminder for public agencies to follow legal guidelines when handling personal information.
GDPR Articles Cited
National Law Articles
The data subject noted that AJPES, the Agency of the Republic of Slovenia for Public Legal Records and Related Services (the controller) made available online on the Slovenian Business Register (PRS) to the public, without any legal basis, information on the address of the permanent and temporary residence of the data subject. The data subject further argued to have sent a deletion request by e-mail concerning the personal data on 22 February 2023 and then on 24 February 2023 - requests rejected by the controller. Thus, on 27 March 2023, the data subject lodged a complaint with the Slovenian DPA. The DPA, thus, initiated its supervision procedure against the controller on the basis of the complainant's request regarding the lawfulness of the processing of personal data. Following the initiation of the proceedings, the controller stated that [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO8547 Article 51 of the National Prevention of Money Laundering and Terrorist Financing Act (Act)], in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO8547 Article 43 of the Act], has, since 2016, required the public disclosure of the data of entities registered in the PRS, including information on their permanent and temporary residence. The Slovenian DPA observed that the controller was obliged to make public the complainant's personal data, including the address of her permanent and temporary residence, on the basis of [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO8547 Article 51 of the Act], in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO8547 Article 43 of the Act]. Such an obligation would then give rise to the exclusion ground for the right to erasure pursuant to Article 17(3)(b) GDPR. However, the DPA noted that the controller not only published the country of residence of the complainant but also the address, which was not required under the national legislation in question. Meanwhile, [http://www.pisrs.si/Pis.web/preg
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for AJPES (Agency of the Republic of Slovenia for Public Legal Records and Related Services) in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. AJPES (Agency of the Republic of Slovenia for Public Legal Records and Related Services) - Slovenia (2023). Retrieved from cookiefines.eu
Last updated: