Court case VSRS Sodba IV Ips 2/2021 – Court Ruling (Slovenia, 2021)

The applicant is an official for the Supreme State Prosecutor's Office. From March and June 2017, the applicant disclosed the personal data of thirty-two data subjects without a legal basis in Slovenian law and without the consent of these data subjects. The Slovenian DPA (Information Commissioner or IP) defined the applicant's disclosures as a repeated violation of the first paragraph of Article 8 of the Slovenian Personal Data Protection Act (ZVOP-1). The IP further determined that the applicant had committed thirty-two offenses under Article 91 of the ZVOP-1. As a result, the Slovenian IP invoked domestic criminal regulating misdemeanor offenses (called the Minor Offenses Act or ZP-1) to impose on the applicant a fine of EUR 830 for each offense, as well as an additional EUR 2,380 sanction. Slovenia remains the only EU country which has not passed a national act implementing the GDPR. The Slovenian legal system does not allow for the issuing of administrative fines by agencies such as a DPA, which means that even courts cannot initiate proceedings. This should not be a barrier to the implementation of the GDPR because Article 83(9) creates an exception for such countries that do not provide administrative fines, allowing them to impose fines through competent national courts. Slovenia negligently failed to invoke this exception at the time of adoption of the GDPR, and instead continues to rely on ZVOP-1 for data protection. In summary, in Slovenia there is no entity that can impose administrative fines as prescribed by the GDPR, but the DPA can at least impose at least misdemeanor fines under ZVOP-1. ZVOP-1 gives the Slovenian DPA the power to directly issue misdemeanor fines through the procedural rules defined by the Minor Offenses Act (ZP-1). ZVOP-1 also sets maximum limits on the fines that the DPA can impose: €1 million for large companies, €300,000 for smaller companies, and €20,000 for individuals. These maximum fines are significantly lower than