# Slovenian DPA: high school breached GDPR security by leaving results list exposed - Type: Enforcement - Source: IP (Slovenia) - Date: 2026-11-04 - Original: https://gdprhub.eu/index.php?title=IP_(Slovenia)_-_0612-35/2026/4 - Canonical: https://overview.legal/posts/607174 - Topics: Supervisory Authorities, Data Breaches, Notification Obligation, Integrity and Confidentiality Principle, Personal Data, Security, Controllers, Supervision, Notified Body Reporting and Notification Obligations, Accountability ## Summary Facts — The DPA received a notification of a data breach at a high school, after which it started an investigation. During a high school graduation celebration, where every student was informed beforehand one by one of their own results, a printed list of every students’ results was accidentally left on a table. Additionally, this list included personal data such as name, date and place of birth, personal identification number, etc. The data was accessible to the students for a few minutes, after which a teacher intervened and put the list away. Some students photographed the documents, stating they only had photographed their own results. The teachers immediately demanded the deletion of these pictures, after which the students did so and declared they had not shared them with anyone else. Holding — The DPA held that the school violated Article 5(1)(f) GDPR by exposing students’ personal data in a publicly accessible setting, and therefore breached the requirement to ensure appropriate security through technical and organizational measures. However, the DPA also held that the school already implemented appropriate measures under Article 24 GDPR, and that the school acted promptly to mitigate the incident and fulfilled its breach-notification obligations. Additionally, the DPA stated that the breach was caused by a one-time employee mistake, and that the exposure was limited in duration and audience. In conclusion, the DPA issued a reprimand under Article 58(2)(b) GDPR as the appropriate corrective measure. ## Full text Date: … … ... The Information Commissioner (hereinafter: IP), acting as the national supervisory authority for the protection of personal data, based on the official notification of a personal data breach dated …, submitted in accordance with the first paragraph of Article 33 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the General Data Protection Regulation), was submitted by the responsible person … (hereinafter: the data controller), hereby initiates, ex officio, an inspection procedure to monitor compliance with the provisions of the General Regulation and the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22; hereinafter: ZVOP-2) and pursuant to Article 58 of the General Regulation and Article 2 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, as amended; hereinafter: ZInfP), Articles 36 and 37 of ZVOP-2, and Articles 207 and 213 of the General Administrative Procedure Act (Official Gazette of the Republic of Slovenia, No. 24/06 – UPB2, as amended; hereinafter: ZUP), issues the following: DECISION I. It is hereby determined that on …, the data controller, by inadvertently disclosing printed personal data … regarding the high school graduation exam at …, violated point (f) of the first paragraph of Article 5 of the General Data Protection Regulation—the principle of integrity and confidentiality. The violation is no longer ongoing as of the date of this decision. II. Pursuant to point (b) of the second paragraph of Article 58 of the General Regulation, a warning is issued to the data controller for the violation of the principle of integrity and confidentiality set forth in point (f) of the first paragraph of Article 5 of the General Regulation. III. There are no specific costs associated with the proceedings. E X P L A N A T O R Y N O T E S I. Introduction and Course of the Proceedings On …, the IP received a notification of a personal data breach, which was submitted by the data controller in accordance with the first paragraph of Article 33 of the General Regulation. Based on this notification, the IP initiated an inspection procedure ex officio. As part of the proceedings, the IP reviewed the data controller’s publicly accessible website and determined that the Personal Data Protection Policy, to which the data controller referred in the official notification, had not been publicly published. The IP therefore, pursuant to Article 29 of the Inspection Supervision Act (ZIN)¹ and point (a) of the first paragraph of Article 58 of the General Regulation, to submit the Personal Data Protection Policy, proof of its adoption, and proof that all employees have been made aware of it. The data controller responded within the set deadline and submitted the following documentation: — Annex 1: Personal Data Protection Policy …, — Annex 2: Instructions for employees on how to act and respond in the event of a personal data breach, — Appendix 3: Minutes of the faculty meeting held on …, which indicate that the principal informed the employees of the Policy and also sent it to them electronically, — Appendix 4: Photograph of the Regulations posted on the school’s bulletin board, — Appendix 5: Certificate confirming the completion of professional training for employees for the year …, — Attachment 6: Email dated … regarding the completion of training for the year … and the re-familiarization of employees with the Rules. The data controller also informed the supervisory authority that it had published the Personal Data Protection Rules on …, i.e., after receiving the supervisory authority’s request, on its website and on the school’s intranet. Since all relevant facts and circumstances were already evident from the notification received and the subsequently submitted documentation, the IP decided without further fact-finding proceedings, in accordance with the principle of procedural economy. Competence of the supervisory authority: The IP notes that the results of the vocational high school graduation exam also constitute examination confidentiality within the meaning of the High School Graduation Exam Act,2 and that, pursuant to Article 57.b of said Act, the Inspectorate of the Republic of Slovenia for Education is responsible for safeguarding such confidentiality. The jurisdiction of the Inspectorate for Education and that of the IP are parallel and independent. The IP is responsible for supervising the protection of personal data under the General Data Protection Regulation and ZVOP-2, regardless of whether the same data is also protected under other legislation. This decision relates exclusively to the protection of personal data and does not affect any assessment of the same incident from the perspective of maintaining the confidentiality of examination results under the Matura Act, for which the Slovenian Education Inspectorate is responsible. II. Established Facts The following facts emerge from the official notification and the subsequently submitted documentation: On …, an official announcement of the results to the high school seniors … took place at the school, followed by a celebration in the school’s … hall. In attendance were … and the entire teaching staff. Each high school graduate was informed only of their own results. During the reception, … accidentally left printed information about the candidates—their results—on the table. The information included the following categories of personal data for each of the …: first and last name, date and place of birth, personal identification number, educational program and title, date and number of the diploma, points earned on the written and oral portions of the four high school graduation exam subjects, points from the practical course in the “Services and Presentation” subject, exam grade for each subject, academic performance in the 3rd and 4th years, overall high school graduation exam performance, and class. The data was accessible to the high school graduates for a few minutes, after which a teacher intervened, realized what was happening, and put the printed documents away. … Meanwhile, the students took photos of the documents, stating that they had photographed only their own information. The homeroom teachers pointed out to the students that the photographed material also contained the personal information of other high school seniors and demanded that they delete the photos immediately. The students assured the teachers that they had deleted the photos and had not shared them with third parties. From the documentation submitted at the request of the supervisory authority, it further appears that the data controller has adopted Rules on the Protection of Personal Data, with which employees were familiarized at a faculty meeting on …, when the Rules were also sent to them electronically. The Policy has been posted on the school’s bulletin board since then. The data controller conducts regular annual professional training for employees in the field of personal data protection, most recently for the year …, and the training for the year … was conducted and documented on …, during which employees were once again familiarized with the content of the Policy. Upon receiving a request from the supervisory authority, the data controller also published the Rules on its website and on the school’s intranet on … III. Legal Assessment III. 1 Violation of the principles of integrity and confidentiality: Point (f) of the first paragraph of Article 5 of the General Regulation—the principle of integrity and confidentiality—stipulates that personal data must be processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures. The IP finds that the data controller violated the aforementioned principle by displaying printed personal data …—including their personal identification numbers—in a publicly accessible location in … This was an unintentional violation resulting from an isolated human error by an employee in the specific handling of printed materials, and not from a systemic lack of organizational measures, as explained below. As of the date of this decision, the violation no longer persists, as the professor has removed the data and ensured that the photographs have been deleted. III. 2 Assessment of Compliance with Article 24 of the General Regulation; Article 24 of the General Regulation stipulates that the controller must, taking into account the nature, scope, circumstances, and purposes of the processing, as well as the risks to the rights and freedoms of natural persons, implement appropriate technical and organizational measures to ensure and demonstrate that the processing is carried out in accordance with the General Regulation. Upon request by the supervisory authority, the data controller submitted the Personal Data Protection Policy (Annex 1) and the Employee Guidelines for Conduct and Action in the Event of a Personal Data Breach (Appendix 2), demonstrated that they had been adopted and that employees had been made aware of them through the minutes of the faculty meeting held on … (Appendix 3), a photograph of the Rules posted on the bulletin board (Appendix 4), and evidence of regular annual professional training for employees for the years … and … (Appendices 5 and 6). Based on the submitted documentation, the IP finds that the obligated party has established appropriate organizational measures within the meaning of Article 24 of the General Regulation—the Rules have been adopted and presented to employees, the Rules are available on the bulletin board, regular training for employees, and internal guidelines for handling violations. The specific incident on … therefore constitutes an isolated deviation from the otherwise established measures, rather than an absence or inadequacy of the organizational system for the protection of personal data as such. III. 3 Proportionality of the measure — warning; Point (b) of the second paragraph of Article 58 of the General Data Protection Regulation authorizes the IP to issue a warning to the controller when the processing has violated the provisions of the General Data Protection Regulation. A warning is the least intrusive corrective measure available to the IP. In assessing the proportionality of the measure, the IP takes into account the following mitigating circumstances: This was a one-time and unintentional violation resulting from the carelessness of an individual employee, rather than from a systemic deficiency or intentional conduct. The data controller took immediate action—the teacher put the materials away promptly, and within half an hour, the principal was notified, who immediately consulted with the authorized data protection officer. On the same day, …, the data controller notified all affected high school seniors in writing of the personal data breach in accordance with Article 34 of the General Data Protection Regulation. The data controller reported the breach to the supervisory authority in accordance with Article 33 of the General Data Protection Regulation, which demonstrates the controller’s good practices and awareness of its obligations under the General Data Protection Regulation. The data were not disclosed to third parties outside the school premises—only the high school seniors and teachers present were exposed, i.e., a limited and specific group of individuals. The exposure lasted only a few minutes. The data controller has appointed an external Data Protection Officer (DPO), with whom it conducts regular annual reviews of compliance with the provisions of the General Data Protection Regulation. The data controller has adopted Rules on the Protection of Personal Data, with which employees have been familiar since …; the Rules are permanently available on the school’s bulletin board. The data controller conducts regular annual professional training for employees in the field of personal data protection, as documented for the years … and …. An internal interview was conducted on the same day with employee …, during which she was reminded of her obligation to protect personal data; the employer will issue her a written warning. Upon request by the IP, the data controller submitted comprehensive and appropriate documentation within the set deadline, demonstrating compliance with Article 24 of the General Data Protection Regulation. After receiving the supervisory authority’s request, the data controller further improved the transparency of its personal data processing practices by publishing the … Personal Data Protection Policy on its website and on the school’s intranet on … Taking into account all of the aforementioned circumstances—in particular, the established and proven data protection system with a designated DPO, the proven fact that employees have been familiar with the Regulations since …, regular training sessions, the immediate and comprehensive response to the incident—including notification of those affected pursuant to Article 34 of the General Data Protection Regulation—and the subsequent publication of the Policy on the website — The IP assesses that a warning pursuant to point (b) of the second paragraph of Article 58 of the General Regulation is a proportionate and sufficient measure for the violation of point (f) of the first paragraph of Article 5 of the General Regulation. Imposing a fine or another more severe measure would not be proportionate given the nature, gravity, and duration of the violation. III. 4 Recommendation The IP recommends that the data controller: — permanently maintain a public posting of the Personal Data Protection Rules on its website and intranet, — supplement the existing Rules and Employee Guidelines with a specific protocol for the secure handling of printed documents containing personal data, particularly regarding their receipt, storage during public and mass events, and secure destruction once their intended purpose has been fulfilled, — continue to conduct regular annual employee training, with a special emphasis on the physical handling of printed materials containing personal data. In this regard, the IP emphasizes that the EMŠO constitutes a specific (national) identifier of an individual within the meaning of Article 87 of the General Regulation. The Constitutional Court of the Republic of Slovenia also confirmed in Decision No. U-I-229/03 of February 9, 2006, that the EMŠO is protected under Article 38 of the Constitution of the Republic of Slovenia and that its processing or disclosure must comply with the requirement of a specific and limited purpose of use. When combined with a person’s name, date of birth, place of birth, and academic performance, the EMŠO further increases the risk of identity theft, particularly in services where identity is verified remotely. The fact that this data was exposed for … individuals simultaneously poses a serious risk to the rights and freedoms of individuals. In this case, the warning is issued taking into account all mitigating circumstances—in particular, the proven existence of an organizational system for the protection of personal data, the data controller’s immediate action, and the reporting of the breach. The IP warns that, in the event of a recurrence of a similar violation, it will conduct an inspection and consider imposing stricter measures in accordance with Article 83 of the General Data Protection Regulation. IV. Decision on Procedural Costs Pursuant to the fifth paragraph of Article 213 of the Administrative Procedure Act (ZUP), the operative part of the decision shall also determine whether any procedural costs have been incurred. The IP determined that no special costs were incurred in these proceedings, as set forth in Point 3 of the operative part of this decision. Information on Legal Remedies: No appeal is permitted against this decision; however, an administrative dispute may be initiated. An administrative dispute is initiated by filing a complaint with the Administrative Court, Fajfarjeva 33, 1000 Ljubljana. The complaint must be filed within thirty days of the service of this decision, in writing directly with the aforementioned court, by certified mail, or orally for the record. If the complaint is sent by certified mail, it is deemed to have been received on time if it was posted on the last day of the deadline for filing the complaint. In addition to the original, a transcript, or a copy of this decision, the complaint must be accompanied by one transcript or copy of the complaint and its attachments for the defendant, and, if anyone is affected by the decision, one for that person as well. …. State Commissioner for Personal Data Protection To be served: ... - electronically ## Cited law provisions (14) ### GDPR — gdpr-art-5-par-1-pnt-f-en processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). ### GDPR — gdpr-art-58-par-2-pnt-b-en to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation; ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-24-en Responsibility of the controller ### GDPR — gdpr-art-29-en The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law. ### GDPR — gdpr-art-33-en Notification of a personal data breach to the supervisory authority ### GDPR — gdpr-art-34-en Communication of a personal data breach to the data subject ### GDPR — gdpr-art-36-en Prior consultation ### GDPR — gdpr-art-37-en Designation of the data protection officer ### GDPR — gdpr-art-57-en Tasks ### GDPR — gdpr-art-58-en Powers ### GDPR — gdpr-art-83-en General conditions for imposing administrative fines ### GDPR — gdpr-art-87-en Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application. In that case the national identification number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. --- Generated by overview.legal · https://overview.legal/posts/607174 · 2026-11-14