IP Slovenia: Controller breached Art. 15(1)(d) and 15(3) GDPR by denying storage info and

Number: 0602-68/2025/18 Date: … The Information Commissioner (hereinafter: IP), pursuant to Articles 2 and 8 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, Nos. 113/05 and 51/07; ZInfP), and Article 77 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the General Regulation) and Article 34 in conjunction with point 2 of the first paragraph of Article 55 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22, 40/25 – ZInfV-1 and 10/26 – ZP-1L; ZVOP-2) in the proceedings initiated by the applicant with special status: … (hereinafter: the applicant), dated …, against the decision of the controller: ….(hereinafter: the controller or …) No. … dated … and letter No. … dated …, in the matter of exercising the right of access to personal data, issues the following DECISION:

The complainant’s complaint …, dated …, against the decision of the controller … No. … dated … and letter No. … dated … is granted.

It is hereby determined that the data controller …, at the time the complainant filed the complaint on …, violated Article 15 of the General Regulation in conjunction with Article 12 of the General Regulation by failing, in letter No. … dated …, failed to provide the applicant with adequate information regarding the anticipated retention period for his personal data, nor the criteria used to determine that period.

It is hereby determined that the controller …, at the time the applicant filed his application dated …, violated Article 15 of the General Regulation by rejecting, through Decision No. … dated …, the applicant’s request for a copy of Document No. … dated … and thereby denying access to his personal data.

The controller is ordered to provide the complainant, within thirty days of the service of this decision, with information regarding the retention period for his personal data to which the request dated … relates, in accordance with point (d) the first paragraph of Article 15 of the General Data Protection Regulation. Within the same timeframe, the controller must also notify the IP of the fulfillment of this obligation.

The controller … is ordered to provide the complainant, within thirty days of the service of this decision, with a copy of document No. … dated …, in which the personal data of third parties is redacted. Within the same time limit, the controller must also notify the IP of the fulfillment of this obligation.

The applicant’s access to the case file maintained under No. … is restricted with respect to: - Document No. …, which is an annex to the controller’s response to the request dated … and is filed under …. namely, until this decision becomes final. Once this decision becomes final, the aforementioned restriction on access to the case file shall apply in accordance with the final decision in this matter.

No special costs were incurred by the authority in these proceedings; the parties shall bear their own costs of the proceedings. E x p l a n a t i o n I. Course of the Proceedings to Date and Relevant Statements 1 In a request dated …, the applicant requested information from the controller regarding the processing of personal data (specifically, whether personal data concerning the applicant is being processed and information regarding the anticipated retention period for such personal data) as well as access to personal data, specifically a photocopy of the response that the controller sent to the Committee for … (…) pursuant to the resolution adopted at the … meeting of the controller’s Administrative Board No. …. 2 The controller issued Decision No. … dated …, by which it rejected the request to obtain a photocopy of the response—i.e., Document No. … dated …— The controller stated that, in addition to the individual’s personal data, the document also contains personal data of third parties, legal opinions, positions, and internal deliberations of the authorities … that arose during the proceedings before the authority. The controller further explained that the requested document is not a collection of the complainant’s personal data, but rather a document containing personal data in the context of the controller’s defense in another proceeding. With regard to the information on the processing of personal data requested by the applicant, the controller, in response No. … dated …, confirmed that it processes personal data for the purpose of maintaining membership records and carrying out procedures in accordance with applicable law. Regarding the retention period, the controller explained that it retains personal data in accordance with applicable law, which specifies retention periods for specific types of documentation. After membership terminates, however, the data is retained for the period necessary to fulfill legal obligations or to safeguard against potential legal claims. 3 The complainant filed a complaint with the IP against the decision in question and the letter dated … The complainant highlighted the second paragraph of the explanatory statement (in which the controller states that the document also contains personal data of third parties, legal opinions, positions, and internal deliberations of the controller’s bodies), regarding which the complainant believes the controller failed to explain why this is a specific document, on the basis of which provisions it is specific, and where its specificity lies, such that it processes personal data that an individual cannot and must not be made aware of. The complainant further stated that the controller had not explained what kind of procedure was involved and on the basis of which legal provisions it had processed his personal data in that procedure. Furthermore, the complainant believes that the controller did not specify how obtaining the document would adversely affect others, nor did it specify which rights and freedoms would be jeopardized. Likewise, regarding the partial redaction of the data, the controller did not explain how the disclosure of the remainder of the document would disproportionately affect others. Regarding the requested information on the processing of personal data—specifically, confirmation of processing—he noted that the statements in question are general and do not specify the precise matter in which personal data is being processed. As for the retention period, the statements provided are also general in nature and do not specify how long the controller will retain the documentation; furthermore, the controller did not cite the legal provisions used to determine the retention period. 4 On …, the IP issued Record of Findings No. …, which is essential for the decision in this proceeding (hereinafter: “preliminary decision”), and a request for a statement prior to the decision. In response to the IP’s request, the complainant submitted a letter dated …, in which he essentially objects to the measure proposed in the preliminary decision—namely, that the data controller be ordered to reconsider the disclosure of document No. … dated … and to provide clarification regarding the intended retention period for the complainant’s personal data. The complainant also proposes that the IP set a short deadline for the controller to remedy the identified violations. The data controller responded to the IP’s request with letter No. … dated … and did not object to the findings of the preliminary decision. 5 The IP assesses that the facts of the case have been fully established, and the parties to the proceedings were given an adequate opportunity to be heard. Since there are no objections or need for further procedural steps, there are no obstacles to issuing this decision. II. General Remarks on the Right of Access of the Data Subject 6 The right of an individual to access their own personal data is a fundamental human right, as set forth in the third paragraph of Article 38 of the Constitution of the Republic of Slovenia, which stipulates that everyone has the right to access the personal data collected about them. This right, referred to as the right of access of the data subject, is specified in Article 15 of the General Regulation, which provides that the data subject to whom the personal data relates, has the right to obtain from the controller: 1) confirmation as to whether personal data concerning him or her is being processed, and, where that is the case, 2) access to the personal data and to a copy thereof, and 3) certain information regarding the processing and the rights subsequently listed in the General Regulation. In accordance with the third paragraph of Article 15 of the General Regulation, the controller is also required to provide the individual with a copy of the personal data being processed free of charge. Furthermore, Article 15 of the General Regulation stipulates that the right to obtain a copy under the third paragraph of this Regulation shall not adversely affect the rights and freedoms of others. 7 In accordance with Point 37 of Guidelines 01/2022 on the rights of data subjects—the right of access—issued by the European Data Protection Board on March 28, 2023 (hereinafter: the Guidelines), “[t]he assessment of the data being processed [must] reflect as closely as possible the current situation at the time the controller receives the request, and the response should include all data available at that time. […] Thus, controllers are not required to provide personal data that they processed in the past and no longer have at their disposal. For example, a controller may have deleted personal data in accordance with its data retention policy and/or legal provisions and may therefore no longer be able to provide the requested personal data. […]” It is therefore permissible to reject a request if the requested personal data no longer exist at the time the access request is received (i.e., the controller no longer processes them).

In accordance with Article 14 of ZVOP-2, controllers that are not state authorities or local self-governing communities generally decide on a request by means of a written notification, regardless of the content of the decision. The decision must include the reasons and information regarding the right to lodge a complaint with the supervisory authority within 15 days of being notified of the decision, in accordance with the provisions of point (f) of the first paragraph of Article 15 of the General Data Protection Regulation. The decision may take the form of an official note, which is sent to the individual in a manner that ensures the individual is informed of the decision and that receipt can be verified. III. Decision-Making Process in the Supervisory Procedure III.1 About the Procedure

The IP conducted the supervisory procedure in question in accordance with the provisions of Articles 30 through 35 of ZVOP-2 (proceedings based on a complaint filed by a complainant with special status). Among other things, this procedure is characterized by the fact that the IP acts in accordance with the investigative and regulatory powers set forth in Article 58 of the General Regulation and Article 28 and 29 of ZVOP-2, as well as in accordance with the general rules of the General Administrative Procedure Act (Official Gazette of the Republic of Slovenia, No. 24/06 – UPB, as amended and supplemented; hereinafter “ZUP”).

Upon request by a complainant with special status, the IP shall conduct a supervisory procedure (Article 30 of ZVOP-2) when the complainant alleges a violation that constitutes a breach of personal data protection regulations, which exists at the time the complaint is filed or, following a complaint, within 15 days of the response regarding the exercise of rights under the General Data Protection Regulation (Article 14 of ZVOP-2). In its decision, the Information Commissioner determines the existence of a violation that existed at the time the complaint was filed (Article 34 of ZVOP-2).

The IP, as the supervisory authority, shall, following the completion of a supervisory procedure in accordance with the first paragraph of Article 34 of ZVOP-2, issue a decision which, in addition to the elements prescribed by the law governing general administrative procedure, shall contain: 1) a finding as to whether or not the alleged violation of the processing of personal data of a complainant in a special situation existed at the time the complaint was filed; 2) measures ordered to be taken by the controller or processor regarding the processing of personal data relating to the complainant in a special situation, and the deadline for their implementation; 3) the permitted scope of access to the case file for the complainant in a special situation. III.2 Scope of the IP’s Oversight

In this supervisory proceeding, the IP determined whether the controller, through its Decision No. … dated … and Response No. … dated …, violated the complainant’s substantive and procedural rights as set forth in the General Data Protection Regulation and ZVOP-2. In this supervisory proceeding, the IP therefore determined whether the controller had justifiably decided on the individual’s request through the cited response and decision dated …. IV. Assessment of the Complainant’s Allegations and the Issue of a Violation of Personal Data Protection

Regarding the retention period for the complainant’s personal data, the data controller explained that it retains personal data in accordance with applicable law, which specifies retention periods for specific types of documentation. After termination of membership, however, the data is retained for the period necessary to fulfill legal obligations or to protect against potential legal claims. The IP finds that the controller did not provide the data subject with sufficiently precise information to enable the data subject to know how long the data relating to him or her would be retained. In accordance with point (d) of the first paragraph of Article 15 of the General Data Protection Regulation, an individual may obtain from the controller information regarding the processing of personal data, including, where possible, the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period. It follows from point 118 of the Guidelines that the information provided by the controller must be sufficiently precise so that the individual knows how long the data concerning him or her will be retained. If the time of erasure cannot be determined, the duration of the retention period and the start of that period or the triggering event must be specified; a mere reference by the controller to, for example, “erasure upon the expiration of the prescribed retention periods” is not sufficient.

The IP finds that, with regard to retention periods, the controller provided the complainant with a very general response that does not specify either the anticipated retention period for personal data or the criteria used to determine that period, thereby violating Article 15 in conjunction with Article 12 of the General Data Protection Regulation (point 2 of the operative part of this decision). The IP therefore ordered the controller, pursuant to point (c) of the second paragraph of Article 58 of the General Data Protection Regulation and point 1 of the first paragraph of Article 29 of ZVOP-2, to explain to the complainant the anticipated retention period for his personal data, as set forth in point 4 of the operative part of this decision. When providing this information to the complainant, the data controller must take into account that, in accordance with point (d) the first paragraph of Article 15 of the General Data Protection Regulation, information regarding the anticipated retention period of personal data (e.g., in days, months, or years) must primarily be provided; and if this is not possible, the controller may provide the criteria used to determine this period (e.g., for each individual personal data file it maintains, the controller shall define the criteria by referring to the relevant legislation that specifies the retention period).

By Decision No. … dated …, the controller rejected the request to provide a copy of Document No. … dated …, on the grounds that the requested document also contains personal data of other individuals, that even a partial disclosure of the document (by redacting the personal data of other individuals) would disproportionately infringe upon the rights of third parties, and that the document in question is not a collection of personal data but rather a document containing personal data in the context of the controller’s defense in another proceeding.

The IP clarifies that the term “copy” in the third paragraph of Article 15 of the General Regulation does not refer to the document as such, but rather to the personal data contained therein. However, in Case C-487/21, dated May 4, 2023, the Court of Justice of the European Union clarified that an individual’s right to obtain from the controller a copy of the personal data being processed also includes the right to obtain copies of extracts from documents or entire documents or extracts from databases, containing such personal data, provided that the provision of such a copy is necessary for the effective exercise of the rights guaranteed to the individual by the General Regulation, while also taking into account the rights and freedoms of others.

Upon reviewing Document No. … dated …, the IP determined that the document relates to the applicant and contains his personal data. Since the document in question relates to the applicant and primarily contains his personal data, which is closely intertwined with other information in the document, the IP considers that merely providing the applicant with a list or inventory of this personal data, without the context of its use, would not enable the applicant to effectively exercise his or her rights under the General Regulation. The IP therefore considers that the requester is also entitled to receive a copy of the entire document, provided that the personal data of third parties is redacted. Since, as explained above, the document in question contains only a small amount of third parties’ personal data, the IP does not agree with the controller’s position that even a partial disclosure of the document (with the personal data of other individuals redacted) would disproportionately interfere with third parties’ rights to the protection of personal data. In light of the foregoing, the IP has determined that, at the time the complainant filed the complaint, the controller, by rejecting the request to provide a copy of document No. … dated …, the controller had violated the complainant’s right of access to personal data under Article 15 of the General Regulation (Point 3 of the operative part of this decision). The IP therefore ordered the controller, pursuant to point (c) of the second paragraph of Article 58 of the General Regulation and point 1 of the first paragraph of Article 29 of ZVOP-2, to grant the complainant’s request for access to his personal data contained in Document No. … dated … by providing the complainant with a copy of that document, in accordance with the provision of the fourth paragraph of Article 15 of the General Regulation, which means that the controller must redact the personal data of third parties before providing a copy of the document in question (Point 5 of the operative part of this decision). In complying with the IP’s order, the controller must take into account that (i) pursuant to Article 4(1) of the General Regulation, personal data means any information relating to an identified or identifiable natural person; an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual; and (ii) that, within the framework of a request under Article 15 of the General Regulation, an individual may access only their own personal data; therefore, the controller must first identify the personal data of the requester/applicant, in accordance with the aforementioned definition, and identify the parts of the document that specifically relate to the applicant/registrant, or determine whether the entire document relates to them, since the applicant is not entitled to access the personal data of other individuals. V. Permitted Scope of File Review

Point 3 of the first paragraph of Article 34 of ZVOP-2 stipulates that a decision in a supervisory proceeding under the provisions of this section, in addition to the elements prescribed by the law governing general administrative proceedings, must also include the permitted scope of access to the case file for a complainant with special status.

The IP, taking into account the provisions of Articles 15 and 18 of ZVOP-2, for the reasons explained by the IP in point 18 above, has decided to impose a restriction on the complainant’s access to the case file, maintained under No. …, with respect to the following documents: - No. …, which is an attachment to the controller’s response to the request dated … and is filed under …, until the decision in this matter becomes final. The IP further decided that, upon this decision becoming final, the aforementioned restriction on access to the case file shall apply in accordance with the final decision in this case (point 6 of the operative part of this decision). VI. Costs of the Proceedings

Pursuant to the first paragraph of Article 118 of the Administrative Procedure Act (ZUP), the authority shall, in its decision, rule on the costs of the proceedings, specifying who shall bear them, their amount, and to whom and by what deadline they must be paid. No special costs were incurred in these supervisory proceedings. The applicant and the controller shall each bear their own costs that may have been incurred as a result of the proceedings (second paragraph of Article 30 of the ZVOP-2), as set forth in point 7 of the operative part of the decision.

Pursuant to the third paragraph of Article 57 of the General Regulation in conjunction with the fourth paragraph of Article 3 of the Administrative Fees Act (Official Gazette of the Republic of Slovenia, No. 106/10 — officially consolidated text, as amended and supplemented). Information on Legal Remedies: No appeal is permitted against this decision; however, a lawsuit may be filed within 30 days of receipt of this decision with the Administrative Court in Ljubljana, Fajfarjeva 33, Ljubljana, in writing directly to the aforementioned court, by certified mail, or orally for the record. If the lawsuit is sent by certified mail, it is considered to have been received on time if it was mailed on the last day of the deadline for filing the lawsuit. The complaint, along with any attachments, must be filed in at least three copies. The original or a certified copy of this decision must also be attached to the complaint, and the court fee must be paid. …. State Supervisor for Personal Data Protection To be served on: - The Complainant: … (in person pursuant to the ZUP), - The Data Controller: … (in person pursuant to the ZUP).