Slovenian DPA fines processor €2,802 for failing to patch known vulnerability (Art. 32)

Number: 0609-42/2026/7 Date: … The Information Commissioner (hereinafter: the Misdemeanor Authority) through an authorized official person … ex officio issues on the basis of the second paragraph of Article 51 and Article 46 of the Misdemeanor Act (Official Gazette of the Republic of Slovenia, No. 29/11 – official consolidated text, 21/13, 111/13, 74/14 – Supreme Court decision, 92/14 – Supreme Court decision, 32/16, 15/17 – Supreme Court decision, 73/19 – Supreme Court decision, 175/20 – ZIUOPDVE, 5/21 – Supreme Court decision, 38/24, 100/25 – ZS-1 and 10/26; hereinafter: ZP-1) and Articles 2 and 8 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05 and 51/07 – ZUstS-A) in the proceedings for an offence against the legal entity …(registration number: …, hereinafter: …. or legal entity), due to an offence under the first paragraph of Article 95 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22, 40/25 – ZInfV-1 and 10/26 – ZP-1L, hereinafter: ZVOP-2) in connection with a) point a) of the fourth paragraph of Article 83 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: the General Regulation), the following DECISION ON AN OFFENCE The offending legal entity: …, is liable for an offence under the first paragraph of Article 95 of the ZVOP-2 in conjunction with point a) of the fourth paragraph of Article 83 of the General Regulation committed by …, at the legal entity …. employed as …, by failing to ensure the implementation of procedures for regular testing, assessment and evaluation of the effectiveness of technical and organizational measures to ensure the security of personal data processing within the online store .... which was based on the platform ..., in connection with the known critical vulnerability ... (…) on ...., publicly known from ..., since in addition to implementing version ... dated ..., he failed to ensure the rotation of the encryption key in the file ... and the implementation of the urgent security patch dated ... (the so-called "..."), which ... as a service provider ... stated in his message as explicit steps to eliminate the critical vulnerability ...., or to subsequently implement version .., which would fully provide security patches for the critical vulnerability ..., although the legal entity ..... acted as a processor of personal data of the company ..., and committed itself by contract ... (...) in Articles 6(1) and 9(4) to maintain the online store ..., eliminate errors and other problems, provide support, carry out regular code reviews and ensure that the latest security patch for … is applied or installed with the prior approval of the client, which resulted in an unknown perpetrator on … being able to exploit a known vulnerability and gain access to the encryption key and insert two malicious … into the online store component on the subpage intended for entering customer data as part of the purchase completion and payment process, thus violating the obligation to ensure the security of personal data under Article 32 of the General Regulation, as he did not implement appropriate technical and organizational measures to ensure an appropriate level of security for the processing of personal data. …. committed the alleged offense in the course of his activities and on behalf of and with the funds of the legal entity …., in which he was employed as … at the time of the offense, as a result of which …. is liable for the offense as a responsible legal entity in accordance with the first paragraph of Article 14 of the ZP-1. Therefore, on the basis of the first paragraph of Article 95 of the ZVOP-2 in conjunction with point a) of the fourth paragraph of Article 83 of the General Regulation and in application of the third paragraph of Article 52 of the ZP-1, Article 115 of the ZVOP-2, the first and second paragraphs of Article 83 of the General Regulation and the second paragraph of Article 26 of the ZP-1, the violator, the responsible legal entity, shall be imposed a FINE in the amount of EUR 2,802 for the offense. The violator, the responsible legal entity …. must pay a fine of 2,802 euros to the recipient's account: Information Commissioner, recipient's IBAN: SI56 0110 0845 0051 825, recipient's bank BIC code: BSLJSI2X, purpose code: GOVT, purpose of payment: 0609-42/2026/7 fine, reference: SI11 12157-7120010- 202655. The violator, the responsible legal entity .... must, on the basis of the first paragraph of Article 143 in connection with the first paragraph of Article 144 and the second paragraph of Article 58 of the ZP-1, pay a court fee of 280 euros. The court fee, which is assessed to the violator for the fine imposed under tariff number 8111 ZST-1, must be paid by the violator as the responsible legal entity to the recipient's account: Information Commissioner, recipient's IBAN: SI56 0110 0845 0162 502, recipient's bank BIC code: BSLJSI2X, purpose code: GOVT, purpose of payment: 0609-42/2026/7 court fee, reference: SI11 12157-7120087- 202656. The violator must pay the full amount of the fine imposed and the court fee within fifteen (15) days after the decision on the misdemeanor becomes final. After the payment deadline has expired, the violator may apply to the authority responsible for forced collection (Financial Administration of the Republic of Slovenia) for payment of the fine and procedural costs (court fee) in installments. If the violator fails to pay the fine and procedural costs (court fees) within the specified period, the unpaid fine and procedural costs (court fees) will be recovered forcibly. LEGAL RULE: A request for judicial protection is permitted against a decision on a misdemeanor. The request must be announced in writing within eight days of receiving this decision at the Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, otherwise it is considered that the person entitled to the request (violator, legal representative or advocate) has waived the right to request judicial protection. The notice of the request is sent by mail or delivered directly in two copies and is considered timely if it is submitted on the last day of the deadline for submitting the notice of the request by registered mail or directly to the authority that issued the decision. The announced filing of a request for judicial protection may be withdrawn until the deadline for submitting the notice of this request has expired. If the person entitled to a request for judicial protection fails to notify or withdraws the notification within the statutory deadline for filing this request, it shall be deemed that he has waived the right to file a request for judicial protection. If none of the persons entitled to a request for judicial protection notify this request, the misdemeanor authority shall not issue a decision on the misdemeanor with justification, but it shall be deemed that a final decision has been served on the day of service of the decision without justification, which shall become final upon the expiry of the deadline for filing a request for judicial protection. When at least one of the persons entitled to a request for judicial protection notifies of the filing of this request, a written decision on the misdemeanor with justification shall be prepared and sent no later than 30 days after receipt of the notification of the filing of a request for judicial protection. In this case, the decision with justification shall be served on all persons entitled to a request for judicial protection. An offender who does not file a request for judicial protection against a minor offence decision shall pay half the amount of the fine within eight days after the expiry of the deadline for filing a request for judicial protection (the half amount of the fine is EUR 1,401), otherwise he must pay the full amount of the fine imposed within the deadline specified in the operative part of this decision. An offender who files a request for judicial protection against a decision but then fails to file a request for judicial protection against the decision with justification must also pay the full amount of the fine imposed within the same deadline specified in the operative part of the decision. If the offender pays half the fine before the expiry of the deadline for filing a request for judicial protection, the request for judicial protection against the decision is not permitted, except in the case where the offender had to pay the fine before the expiry of the deadline for filing a request in accordance with the provisions of ZP-1. Under the conditions and in accordance with the regulations governing the financial operations of the minor offence authority, the offender may also pay the fine and the costs of the procedure with a non-cash means of payment. Authorized official: …, State Supervisor for Personal Data Protection Attachment: • Official note on the calculation of the fine. To be served: • … – with a delivery note according to the ZUP, with an attachment.