# IP (Slovenia) - 0609-113/2025/9

- Type: Enforcement
- Source: IP (Slovenia)
- Date: 2026-09-01
- Original: https://gdprhub.eu/index.php?title=IP_(Slovenia)_-_0609-113/2025/9
- Canonical: https://overview.legal/posts/353645
- Topics: Personal Data, Supervisory Authorities

## Summary

Facts — Paper documents containing the personal data of employees (the data subjects) were meant to be destroyed at a company (the controller). The personal data in these documents included the first name, last name, insurance number, date of birth, residential address, and gender of the data subjects. The discarded paper documents were left completely unsecured and accessible to anyone. Holding — The DPA issued the controller a fine of €5,320 for infringements of Articles 32 and 5(1)(f) GDPR. The DPA held that the controller had failed to implement appropriate technical and organisational measures required by Article 32 GDPR to ensure an adequate level of security in the processing of employees’ personal data. According to the DPA, such measures would have prevented unauthorised disclosure of and access to personal data. Furthermore, the DPA held that the controller had also violated the principles of integrity and confidentiality set forth in Article 5(1)(f) GDPR.

## Full text

Number: 0609-113/2025/9 Date: … The Information Commissioner (hereinafter: the administrative authority) issues this decision through the authorized official …, the State Supervisor for Personal Data Protection, in the performance of her official duties pursuant to the second paragraph of Article 51 and Article 46 of the Minor Offenses Act (Official Gazette of the Republic of Slovenia, No. 29/11—official consolidated text, 21/13, 111/13, 74/14—Constitutional Court Decision, 92/14—Constitutional Court Decision, 32/16, 15/17—Constitutional Court Decision, 73/19—Constitutional Court Decision, 175/20—ZIUOPDVE, 5/21—Constitutional Court Decision, 38/24, 100/25 – ZS-1, and 10/26; hereinafter: ZP-1), Articles 2 and 8 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, Nos. 113/05 and 51/07 – ZUstS-A, hereinafter: ZInfP), in the administrative proceeding against the legal entity …, registration number: …. (hereinafter: …), for an administrative offense under the first paragraph of Article 95 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22, 40/25 – ZInfV-1 and 10/26 – ZP-1L; hereinafter ZVOP-2) in conjunction with subparagraph (a) of the fifth paragraph of Article 83 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: the General Regulation), the following DECISION ON AN ADMINISTRATIVE OFFENSE The offender, the responsible legal entity: …, registration number: …, is liable for an administrative offense under the first paragraph of Article 95 of ZVOP-2 in conjunction with point (a) of the fifth paragraph of Article 83 of the General Regulation committed on … by …, in that, as the responsible person of the legal entity …, when destroying the personal data of individuals employed by the legal entity, which were contained in paper documents, failed to ensure the appropriate security of such processing, as he failed to ensure the implementation of appropriate organizational measures in accordance with the provisions of Article 32 of the General Data Protection Regulation, which would have prevented unauthorized disclosure of and access to personal data; as a result, on the date the violation was committed, the document …, which contained the personal data of the employee … (first name, last name, insurance number, date of birth, residential address, employer information, gender), including his or her personal health data (…), and the document …, which contained the personal data of the employee … (first name, last name, employer’s name, date …), were found among the discarded documentation of the legal entity, which was completely unsecured and accessible to anyone, having been discarded … at the location between …, from … onward, …, thereby violating the fundamental principle of integrity and confidentiality regarding the processing of personal data, as set forth in point (f) of the first paragraph of Article 5 of the General Data Protection Regulation, since, in the aforementioned processing (destruction) of personal data, he failed to implement appropriate technical and organizational measures to ensure an adequate level of security in the processing of employees’ personal data at the legal entity. … committed the above-alleged violation through his act (omission) in the course of business and on behalf of and using the resources of the legal entity …, at which he was authorized to perform work at the time the violation was committed …, as a result of which the legal entity … is liable for the aforementioned violation as the responsible legal entity in accordance with the first paragraph of Article 14 of ZP-1. The violators of the liable legal entity are therefore liable, pursuant to the first paragraph of Article 95 of ZVOP-2 in conjunction with point (a) of the fifth paragraph of Article 83 of the General Regulation and by application of the third paragraph of Article 52 of the ZP-1, Article 115 of the ZVOP-2, the first and second paragraphs of Article 83 of the General Regulation, and the second paragraph of Article 26 of the ZP-1 for the administrative offense a f i n e A FINE in the amount of 5,320 EUR. The offender, the responsible legal entity …, must pay the fine in the amount of 5,320 euros to the following account: Information Commissioner, Recipient’s IBAN: SI56 0110 0845 0051 825, Recipient’s bank BIC code: BSLJSI2X, purpose code: GOVT, payment purpose: 0609-113/2025/9 fine, reference: SI11 12157-7120010- 202662. The offender, the responsible legal entity … must, pursuant to the first paragraph of Article 143 in conjunction with the first paragraph of Article 144 and the second paragraph of Article 58 of ZP-1, pay a court fee in the amount of 532 euros. The court fee, which is assessed against the violator for the imposed fine under tariff number 8111 of ZST-1, must be paid by the violator, as the liable legal entity, to the recipient’s account: Information Commissioner, Recipient’s IBAN: SI56 0110 0845 0162 502, Recipient’s bank BIC code: BSLJSI2X, purpose code: GOVT, payment purpose: 0609-113/2025/9 court fee, reference: SI11 12157-7120087-202663. The offender must pay the full amount of the imposed fine and the court fee within fifteen (15) days after the decision on the administrative offense becomes final. After the payment deadline has expired, the offender may apply to the authority responsible for enforced collection (the Financial Administration of the Republic of Slovenia) to pay the fine and procedural costs (court fees) in installments. If the offender fails to pay the fine and the procedural costs (court fees) within the specified time limit, the unpaid fine and procedural costs (court fees) will be collected by enforcement. LEGAL NOTICE: A request for judicial review may be filed against this decision on an administrative offense. The request must be submitted in writing within eight days of receiving this decision to the Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, within eight days of receiving this decision; otherwise, the person entitled to file the appeal (the offender, legal representative, or defense counsel) is deemed to have waived the right to seek judicial review. The notice of the request must be sent by mail or delivered in person in two copies and is considered timely if it is submitted on the last day of the deadline for filing the notice of the request, either by certified mail or in person to the authority that issued the decision. A notice of intent to file a request for judicial protection may be withdrawn until the deadline for filing such a notice expires. If the person entitled to file a request for judicial protection fails to give notice of such a request within the statutory deadline or withdraws the notice, they are deemed to have waived their right to file a request for judicial protection. If none of the persons entitled to seek judicial protection give notice of such a request, the administrative authority shall not issue a decision on the administrative offense with a statement of reasons; rather, a final decision without a statement of reasons shall be deemed to have been served on the date of service of the decision, and such decision shall become final upon the expiration of the deadline for filing a notice of intent to seek judicial review. If at least one of the parties entitled to file a request for judicial review announces the filing of such a request, a written decision on the administrative offense, including a statement of reasons, shall be issued and sent no later than 30 days after receipt of the notice of intent to file a request for judicial review. In this case, the reasoned decision shall be served on all persons entitled to file a request for judicial review. An offender who does not give notice of an appeal against the decision on the administrative offense shall pay half the amount of the fine within eight days after the expiration of the deadline for giving notice of the appeal (half the fine amounts to 2,660 EUR); otherwise, the offender must pay the full amount of the imposed fine within the time limit specified in the operative part of this decision. Within the same time limit specified in the operative part of the decision, an offender who files a notice of intent to seek judicial review of the decision but subsequently fails to file a substantiated appeal against the decision must also pay the full amount of the imposed fine. If the violator pays half of the fine before the deadline for filing a request for judicial review expires, the request for judicial review of the decision shall not be permitted, except in cases where the offender was required to pay the fine before the expiration of the deadline for filing such a request in accordance with the provisions of ZP-1. Subject to the conditions and in accordance with the regulations governing the financial operations of the administrative offense authority, the offender may also pay the fine and the costs of the proceedings by non-cash means of payment. Authorized Official: … State Inspector for Personal Data Protection To be served:  … – by certified mail in accordance with the ZUP

---
Generated by overview.legal · https://overview.legal/posts/353645 · 2026-09-02