# Legal Entity: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Slovenian Supervisory Authority (Informacijski pooblaščenec)
- Date: 2025-12-11
- Original: https://www.enforcementtracker.com/ETid-3012
- Canonical: https://overview.legal/posts/52366
- Topics: Social Media, Employees, Controllers, Supervisory Authorities, Processing, Processing Agreement, Supervision, Law Enforcement, Data Controller

## Summary

The Slovenian DPA has imposed a fine of EUR 75,474 on a legal entity. Without a sufficient legal basis, the controller installed software on an employee's work computer which allowed them to monitor all of the employee's activity on that computer, including private activity. The software also allowed the controller to monitor private communications via Facebook or email, as well as audio conversations. The entity was fined EUR 71,474, and the person responsible was fined EUR 4,000.

## Full text

The Slovenian DPA has imposed a fine of EUR 75,474 on a legal entity. Without a sufficient legal basis, the controller installed software on an employee's work computer which allowed them to monitor all of the employee's activity on that computer, including private activity. The software also allowed the controller to monitor private communications via Facebook or email, as well as audio conversations. The entity was fined EUR 71,474, and the person responsible was fined EUR 4,000.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 (1) GDPR
Industry: Employment

---
Generated by overview.legal · https://overview.legal/posts/52366 · 2026-08-22