Slovenian DPA fines controller €1,198 for Art. 32 GDPR breach via pirated software

Number: 0609-36/2026/7 Date: … The Information Commissioner (hereinafter: the Misdemeanor Authority) through an authorized official person … ex officio issues on the basis of the second paragraph of Article 51 and Article 46 of the Misdemeanor Act (Official Gazette of the Republic of Slovenia, No. 29/11 – official consolidated text, 21/13, 111/13, 74/14 – decision of the Supreme Court, 92/14 – decision of the Supreme Court, 32/16, 15/17 – decision of the Supreme Court, 73/19 – decision of the Supreme Court, 175/20 – ZIUOPDVE, 5/21 – decision of the Supreme Court, 38/24, 100/25 – ZS-1 and 10/26; hereinafter: ZP-1) and Articles 2 and 8 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05 and 51/07 – ZUstS-A) in the proceedings for an offence against the legal entity … (registration number: …, hereinafter: …. or legal entity), due to an offence under the first paragraph of Article 95 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22, 40/25 – ZInfV-1 and 10/26 – ZP-1L, hereinafter: ZVOP-2) in connection with a) point a) of the fourth paragraph of Article 83 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: the General Regulation), the following DECISION ON AN OFFENCE The offender is the legal entity responsible: …, is liable for an offence under the first paragraph of Article 95 of the ZVOP-2 in conjunction with point a) of the fourth paragraph of Article 83 of the General Regulation, committed on … in … by …, at the legal entity …. employed as …, by failing to ensure appropriate technical and organizational measures to ensure the security of personal data processing, which would ensure the confidentiality of individuals' data within the online store of the legal entity …, since pirated and unlicensed software (…) was used in the creation of the said website on the platform …, which contained malicious code in the file … and was not updated, which allowed an unknown attacker to gain unauthorized access to the server and database of the legal entity's customers, in which the personal data of … individuals were stored, namely their name and surname, address, telephone number, email address and order information, thereby violating the obligation to ensure the security of personal data under Article 32 of the General Regulation, as it failed to implement appropriate technical and organizational measures to ensure an appropriate level of security of personal data processing. The perpetrator … committed the offense in the course of carrying out activities and on behalf of and with the means of the legal entity …., where she was employed as … at the time of the offense, as a result of which the legal entity …. for the said offence, in accordance with the first paragraph of Article 14 of the ZP-1, he is liable as a responsible legal entity. The offender, the responsible legal entity, is therefore, on the basis of the first paragraph of Article 95 of the ZVOP-2 in conjunction with point a) of the fourth paragraph of Article 83 of the General Regulation and in application of the third paragraph of Article 52 of the ZP-1, Article 115 of the ZVOP-2, the first and second paragraphs of Article 83 of the General Regulation and the second paragraph of Article 26 of the ZP-1, a FINE in the amount of EUR 1,198 shall be imposed on the offender, the responsible legal entity …. must pay a fine of 1,198 euros to the recipient's account: Information Commissioner, recipient's IBAN: SI56 0110 0845 0051 825, recipient's bank BIC code: BSLJSI2X, purpose code: GOVT, purpose of payment: 0609-36/2026/7 fine, reference: SI11 12157-7120010- 202657. The violator, the responsible legal entity ….. must, pursuant to the first paragraph of Article 143 in connection with the first paragraph of Article 144 and the second paragraph of Article 58 of the ZP-1, pay a court fee of 120 euros. The court fee, which is assessed to the violator for the fine imposed under tariff number 8111 ZST-1, must be paid by the violator as the responsible legal entity to the recipient's account: Information Commissioner, recipient's IBAN: SI56 0110 0845 0162 502, recipient's bank BIC code: BSLJSI2X, purpose code: GOVT, purpose of payment: 0609-36/2026/7 court fee, reference: SI11 12157-7120087-202658. The violator must pay the full amount of the fine imposed and the court fee within fifteen (15) days after the decision on the misdemeanor becomes final. After the payment deadline has expired, the violator may apply to the authority responsible for forced collection (Financial Administration of the Republic of Slovenia) for payment of the fine and procedural costs (court fee) in installments. If the violator fails to pay the fine and procedural costs (court fees) within the specified period, the unpaid fine and procedural costs (court fees) will be recovered forcibly. LEGAL RULE: A request for judicial protection is permitted against a decision on a misdemeanor. The request must be announced in writing within eight days of receiving this decision at the Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, otherwise it is considered that the person entitled to the request (violator, legal representative or advocate) has waived the right to request judicial protection. The notice of the request is sent by mail or delivered directly in two copies and is considered timely if it is submitted on the last day of the deadline for submitting the notice of the request by registered mail or directly to the authority that issued the decision. The announced filing of a request for judicial protection may be withdrawn until the deadline for submitting the notice of this request has expired. If the person entitled to a request for judicial protection fails to notify or withdraws the notification within the statutory deadline for filing this request, it shall be deemed that he has waived the right to file a request for judicial protection. If none of the persons entitled to a request for judicial protection notify this request, the misdemeanor authority shall not issue a decision on the misdemeanor with justification, but it shall be deemed that a final decision has been served on the day of service of the decision without justification, which shall become final upon the expiry of the deadline for filing a request for judicial protection. When at least one of the persons entitled to a request for judicial protection notifies of the filing of this request, a written decision on the misdemeanor with justification shall be prepared and sent no later than 30 days after receipt of the notification of the filing of a request for judicial protection. In this case, the decision with justification shall be served on all persons entitled to a request for judicial protection. An offender who does not file a request for judicial protection against a minor offence decision shall pay half the amount of the fine within eight days after the expiry of the deadline for filing a request for judicial protection (the half amount of the fine is EUR 599), otherwise he must pay the full amount of the fine imposed within the deadline specified in the operative part of this decision. An offender who files a request for judicial protection against a decision but then fails to file a request for judicial protection against the decision with justification must also pay the full amount of the fine imposed within the same deadline specified in the operative part of the decision. If the offender pays half the fine before the expiry of the deadline for filing a request for judicial protection, the request for judicial protection against the decision is not permitted, except in the case where the offender had to pay the fine before the expiry of the deadline for filing a request in accordance with the provisions of ZP-1. Under the conditions and in accordance with the regulations governing the financial operations of the minor offence authority, the offender may also pay the fine and the costs of the procedure with a non-cash means of payment. Authorized official: …, State Supervisor for Personal Data Protection Attachment: • Official note on the calculation of the fine. To be served: • … – with a delivery note according to the ZUP, with an attachment.