Full text
Number: 06111-65/2023/12 Date: …. The Information Commissioner (hereinafter: IP), acting as the national supervisory authority for the protection of personal data …, issues the following pursuant to Article 77 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the General Regulation) and Article 34 in conjunction with point 2 of the first paragraph of Article 55 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22, 40/25 – ZInfV-1 and 10/26 – ZP-1L; hereinafter: ZVOP-2) in the proceedings initiated by the complainant with special status …, represented by Attorney …, against the supervised controller …, represented by the law firm …, the following DECISION 1. It is hereby determined that the supervised controller … at the time of the complainant’s filing of the complaint … on … violated the principle of lawfulness under point (a) and the principle of proportionality under point (c) of the first paragraph of Article 5, as well as the first paragraph of Article 6 of the General Regulation. 2. No measures regarding the processing of personal data shall be ordered against the supervised controller …. 3. The complainant’s … request is dismissed in the part relating to the unlawful access to his or her email on … 4. The complainant … is granted full access to the case file maintained under No. …. 5. No special costs were incurred by the authority in these proceedings; each party shall bear its own costs of the proceedings. E x p l a n a t i o n 1. Course of the proceedings to date and relevant statements In the complaint dated …, the complainant stated that the supervised operator mishandled his email during the period …, as it accessed the email and redirected it to a shared email address … thereby enabling third parties to access it. The complainant attached to the complaint a power of attorney dated …, an employment contract dated …, and a written reminder to fulfill obligations dated …. The IP notified the supervised controller of the complaint, and the controller responded with a letter dated …. The complainant was employed until …, serving as … from … until the termination of the employment relationship. During the employment relationship, he performed the work of …, which was one of the key functions in the company’s operations, and was responsible for approximately … of all customers, which is why his email address contained information necessary for providing services, invoicing services rendered, and collecting debts. This information was essential for the smooth operation of the business, and significant business damage would have occurred had it not been made available. The supervised operator further states that, following the complainant’s prolonged absence, it sought to communicate with him regarding a possible return-to-work date and the handover of data necessary for the smooth operation of the business, but the complainant did not respond. In the month of …, there was a lack of marketing activities and a decline in orders from the clients managed by the complainant. As a result, on …, the supervised operator reviewed the applicant’s email traffic and determined that a large number of unread messages had accumulated during his absence, which had not been forwarded to another address. In its response, the supervised operator further points out that, despite the automatic out-of-office reply being set up, a large number of senders did not forward their emails to the address provided in the notification. Several time-sensitive projects of critical importance to business operations were underway. However, the employees who were filling in for the complainant were unable to properly manage their work without the information contained in the complainant’s email. To maintain business continuity and prevent business losses, the supervised administrator temporarily redirected email from the address … to the address … The emails were redirected to a folder accessible to the employee who was covering for the absent employee during that time. The supervised controller states that, in order to prevent greater and more serious harm and to ensure uninterrupted business operations, given the circumstances, no less restrictive measure was available, and therefore the controller’s legitimate interests prevailed over the interests of the individual employee. This involved an exceptional and short-term redirection of the work email address. On the date the employment relationship ended, the complainant’s email address was deactivated and an automatic reply notifying of the deactivation of that email address was set up. In response to specific questions from the IP, the supervised controller further clarified that the legal basis for accessing the traffic data of the complainant’s email address is based on points (c) and (f) of the first paragraph of Article 6 of the General Data Protection Regulation, while the legal basis for redirecting emails is point (f) of the first paragraph of Article 6 of the General Data Protection Regulation. The supervised controller further explained that, in light of the situation, it had adopted corrective measures to minimize the likelihood of such incidents recurring. Internal guidelines were issued to employees stating that all critical business documentation must be sent from their personal email addresses to a shared address as well. Before any absence, employees are required to set up an automatic out-of-office notification, specifying the expected duration of their absence and the email address to which the sender should forward messages during that time. The supervised controller will also undertake a comprehensive update of its personal data protection framework. The supervised controller attached to its response the minutes of … dated … and the Rules on Procedures and Measures for the Protection of Personal Data of the company … dated …. Based on the statements of the complainant and the supervised controller, on … the IP issued a record of findings essential to the decision in this proceeding, along with a request for a statement prior to the decision, namely that the established facts support the conclusion that, at the time the complaint was filed, the supervised controller violated the principles of lawfulness and proportionality by redirecting an email addressed to the complainant to another email address without an appropriate legal basis. Since the complainant’s employment relationship with the supervised operator had ended and since his e-mailemail address had been deactivated, the IP determined that no additional measures need to be ordered against the supervised controller to restore compliance with the law. In response to the request, the complainant issued a statement dated … stating that he fully agreed with the IP’s findings that no appropriate legal basis had been provided and that the measure was clearly disproportionate. Instead of a limited, targeted intervention to the extent strictly necessary, systematic and permanent access to the complainant’s communications was granted, which effectively amounts to constant monitoring of his email inbox. In this regard, the complainant points out that an automatic reply had already been set up during his absence, which informed senders of his absence and directed them to another contact. This means that there was a significantly less intrusive and appropriate alternative that would have allowed for uninterrupted business operations without interfering with the complainant’s personal data. The complainant further emphasizes that the reference to preventing business damage is unfounded, as this does not automatically justify an interference with an individual’s fundamental rights. The supervised controller, through its authorized representative, also responded to the request and proposed that the Court find that the violation alleged by the complainant did not occur, as it had conducted a legitimate interest test. While no specific format is prescribed, the test must be conducted, and the results of this balancing test must be capable of being demonstrated retrospectively. Consequently, written documentation is recommended but not mandatory. The test is derived from the sequence of actions and the gradual escalation of measures taken prior to the redirection of the email. The automated response proved to be an ineffective measure, as a review of traffic data showed that, despite the notification, customers continued to send messages; consequently, the supervised operator determined that the goal of ensuring uninterrupted business operations could not be achieved through less restrictive measures. Subsequently, the supervised operator attempted to contact the employee to obtain the necessary information or arrange for the transfer of tasks, but was unsuccessful. This also served to explore the possibility of organizational solutions without interfering with the employee’s email. Only after determining that (1) less intrusive measures were ineffective, (2) contact with the employee was not possible, and (3) concrete and escalating business damage was occurring, did the controller carry out a commission-authorized inspection, on the basis of which it temporarily redirected email, implementing both measures in a manner that was limited in terms of content, duration, and organizational scope. The data controller thus satisfied all three elements of the legitimate interest test: identification of a legitimate interest (ensuring uninterrupted business operations and preventing business damage), verification of the necessity of processing (by applying and evaluating less intrusive measures and determining their ineffectiveness), and conducting a balancing test between the rights and interests of the complainant and its own legitimate interest, on the basis of which it was determined that the complainant’s rights do not outweigh the legitimate interest of the supervised controller. The fact that the test was not formalized in advance in the form of a written document does not mean that the test was not conducted. What is essential is that the test was actually carried out and that it can be objectively reconstructed retrospectively. For this reason, the redirection of the complainant’s email was justifiably based on point (f) of the first paragraph of Article 6 of the General Data Protection Regulation. In redirecting the email, however, the supervised controller also took into account the principle of data minimization, as communication with external stakeholders could not have been handled in any other, less intrusive manner. It is also important to note that, in accordance with internal guidelines, work email was not used for private purposes, which meant that employees’ reasonable expectation of privacy when using work email was minimal. Furthermore, it is also significant that the complainant was employed in the position of …, one of the key roles, and was thus responsible for approximately … clients, with all related data stored exclusively at his email address. Since the IP assessed that the facts of the case had been fully established for the purpose of deciding this matter, it did not undertake any further procedural actions. 2. Supervisory Procedure The first paragraph of Article 30 of ZVOP-2 stipulates that an individual who believes that the processing of his or her personal data by a controller or processor violates the provisions of the General Regulation, this Act, or other laws governing the processing or protection of personal data, or violates the provisions of subordinate legislation related to these laws or general acts for the exercise of public authority, file a request with the supervisory authority in accordance with the law governing general administrative procedure, requesting a review of the lawfulness of the processing of their personal data, and may also propose in such a request the necessary measures in accordance with the preceding article in the event of established violations, so as to restore compliance with the law. The second paragraph of the same article of ZVOP-2 stipulates that each party shall bear its own costs of the proceedings. Therefore, the IP considered the complaint in proceedings initiated at the request of a complainant with special status, thereby ensuring the right to lodge a complaint under Article 77 of the General Data Protection Regulation. In this supervisory proceeding, the IP acted in accordance with the provisions of Articles 30 through 35 of ZVOP-2. A key feature of this procedure is that the IP acts in accordance with the investigative and regulatory powers set forth in Article 58 of the General Regulation and Articles 28 and 29 of ZVOP-2, as well as in accordance with the general rules of the General Administrative Procedure Act (ZUP), Official Gazette of the Republic of Slovenia, No. 24/06—consolidated text, 105/06—ZUS-1, 126/07, 65/08, 8/10, 82/13, 175/20 – ZIUOPDVE, 3/22 – ZDeb, and 85/25; hereinafter: ZUP). The IP, as the supervisory authority, shall, following the completion of the supervisory procedure in accordance with the first paragraph of Article 34, issue a decision which, in addition to the elements prescribed by the law governing general administrative procedure, shall contain: 1) a finding as to whether or not the alleged violation involving the processing of personal data of a data subject in a special situation existed at the time the complaint was filed; 2) measures ordered to be taken by the controller or processor regarding the processing of personal data relating to the complainant in a special situation, and the deadline for their implementation; 3) the permitted scope of access to the case file for the complainant with a special status. Pursuant to Article 25 of ZVOP-2, in proceedings before the supervisory authority under this Act, the provisions of the law governing general administrative procedure shall apply, unless this Act provides otherwise. In accordance with Article 129 of the General Administrative Procedure Act (Official Gazette of the Republic of Slovenia, No. 24/06—consolidated text, 105/06—ZUS-1, 126/07, 65/08, 8/10, 82/13, 175/20 – ZIUOPDVE, 3/22 – ZDeb, and 85/25; hereinafter: ZUP), the authority shall first examine the request and dismiss it by decision if the matter to which the application relates is not an administrative matter (Article 129, paragraph 1, point 1) or if the applicant does not assert any of their rights or legal interests in the application, or if they cannot be a party under this Act (point 2 of the first paragraph of Article 129). The second paragraph of the same article provides that the authority may also dismiss the request at any time during the proceedings until a decision is issued, if the grounds set forth in the preceding paragraph of this article are present. In its preliminary review of the application, the IP determined that the application contains all the necessary elements for it to be considered, in particular, the identification of the supervised controller and a description of the alleged violation, which constitutes a breach of personal data protection regulations. In the case at hand, the alleged violation concerns whether the supervised controller lawfully accessed the complainant’s email on … and subsequently redirected it to another email address until … With regard to the access to the complainant’s email on …, the IP determined that this was a one-time act that was fully completed prior to the filing of the complaint on …, and therefore the allegation of a violation does not meet the condition that the violation would (still) exist at the time the complaint was filed. Therefore, this part of the complaint must be dismissed, since the judicial protection provided for under the third paragraph of Article 11 of the ZVOP-2 for determining violations established by the General Data Protection Regulation or by laws governing the processing or protection of personal data that have ceased to exist judicial protection is provided for under the third paragraph of Article 11 of ZVOP-2, which means that decisions on such claims fall within the jurisdiction of the courts. Both parties agreed with the foregoing. Based on the foregoing, the IP decided to dismiss the complaint regarding the unlawful access to the complainant’s email, as set forth in the third point of the operative part. 3. General Remarks on the Lawfulness of Personal Data Processing The protection of personal data is in accordance with Article 38 of the Constitution of the Republic of Slovenia (Official Gazette of the Republic of Slovenia, No. 33/91-I, 42/97 – UZS68, 66/00 – UZ80, 24/03 – UZ3a, 47, 68, 69/04 – UZ14, 69/04 – UZ43, 69/04 – UZ50, 68/06 – UZ121, 140, 143, 47/13 – UZ148, 47/13 – UZ90, 97, 99, 75/16 – UZ70a, 92/21 – UZ62a, and 98/25 – UZ74a; hereinafter: the Constitution of the Republic of Slovenia) is a fundamental human right and freedom. The first paragraph of Article 38 of the Constitution of the Republic of Slovenia stipulates that the protection of personal data is guaranteed and that the use of personal data contrary to the purpose for which it was collected is prohibited. The second paragraph of the same article further stipulates that the collection, processing, purpose of use, supervision, and protection of the confidentiality of personal data are governed by law. The protection of personal data is also guaranteed by the Charter of Fundamental Rights of the European Union, which stipulates in Article 8 that everyone has the right to the protection of personal data concerning them. Personal data must be processed fairly, for specified purposes, and on the basis of the data subject’s consent or another legitimate basis provided by law. More detailed provisions regarding the protection of individuals’ personal data are set forth in the General Data Protection Regulation and ZVOP-2. Pursuant to the first paragraph of Article 6 of the General Data Protection Regulation, the processing of personal data is lawful only to the extent that at least one of the following conditions is met: (a) the data subject has given consent to the processing of his or her personal data for one or more specified purposes; (b) the processing is necessary for the performance of a contract to which the data subject is a party or for taking steps at the request of such a data subject prior to entering into a contract; (c) the processing is necessary for compliance with a legal obligation to which the controller is subject; (d) the processing is necessary to protect the data subject or another natural person; (e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) the processing is necessary for the legitimate interests pursued by the controller or by a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, override such interests. Point (f) of the first subparagraph does not apply to processing by public authorities in the performance of their duties. ZVOP-2, regarding the legal bases for the processing of personal data in the first paragraph of Article 6, stipulates that personal data may be processed only when and to the extent that it is in accordance with the legal grounds for the processing of personal data set forth in the first paragraph of Articles 6 and 9 of the General Regulation. The first paragraph of Article 5 of the General Regulation, which governs the fundamental principles regarding the processing of personal data, first establishes the requirement that personal data be processed lawfully, fairly, and in a transparent manner in relation to the data subject. Personal data must be collected for specified, explicit, and legitimate purposes and must not be further processed in a manner incompatible with those purposes (purpose limitation). Furthermore, personal data must be adequate, relevant, and limited to what is necessary for the purposes for which they are processed (data minimization). Personal data may be stored in a form that allows the identification of the individuals to whom the personal data relates only for as long as is necessary for the purposes for which it is processed (storage limitation). In accordance with the second paragraph of Article 5 of the General Regulation, the controller is responsible for compliance with the principles set forth in the first paragraph of this Article and must be able to demonstrate such compliance. 4. Assessment of the Parties’ Statements Regarding the Redirection of Email It is not disputed between the parties that on … the complainant’s email was redirected to a shared email address and that this redirection continued until the termination of the employment relationship on …. The parties disagree regarding the legality of this redirection. The complainant asserts that there was no appropriate legal basis for the redirection—namely, point (f) of the first paragraph of Article 6 of the General Regulation—and that the redirection did not constitute a proportionate measure. Conversely, the supervised operator argues that the reassignment was carried out pursuant to point (f) of the first paragraph of Article 6 of the General Regulation, as it was strictly necessary to prevent an imminent threat of business damage and to ensure the smooth operation of the business. The decision in this case therefore depends on determining whether there was an appropriate legal basis for redirecting the complainant’s email, point (f) of the first paragraph of Article 6 of the General Regulation, and whether this redirection was proportionate. With regard to the legitimate interests test—a prerequisite for this legal basis—the supervised controller asserts that formal documentation is not required, but the test must be conducted, and the controller must be able to demonstrate it retrospectively. The supervised controller demonstrates that this was the case through the sequence of actions taken and the escalation of measures applied prior to the redirection. With regard to the legal basis under point (f) of the first paragraph of Article 6 of the General Data Protection Regulation, it must first be noted that the supervised controller is part of the private sector (point 4 of the second paragraph of Article 5 of ZVOP-2) and may therefore rely on this legal basis. To demonstrate the lawfulness of the processing of personal data on this legal basis, both formal and substantive conditions must be met. The formal conditions relate to the supervised controller’s ability, in accordance with the principle of accountability, to demonstrate that the aforementioned test has been conducted, which means that there must be objective circumstances on the basis of which the supervisory authority can assess whether and how the assessment of the existence of legitimate interests was conducted. The supervised controller asserts that the conduct of the lawfulness test does not require formality, but rather requires that the test be performed and that there be the ability to subsequently demonstrate the balancing of interests or provide an objective reconstruction. Therefore, written documentation is recommended but not mandatory. The General Regulation does not explicitly require that the legitimate interests test be prepared or conducted in writing, but, in accordance with the second paragraph of Article 5 of the General Regulation, it does require that the controller be able to demonstrate compliance. Consequently, while there is no explicit formal requirement, there is a substantive one. A characteristic of this legal basis is that the processing of personal data is not predetermined, as is the case with points (c) and (e) of the first paragraph of Article 6 of the General Regulation, and that it is not based on the will of the individual whose personal data is being processed, as is the case with points (a) and (b) of the first paragraph of Article 6 of the General Regulation, but rather on the objective circumstances of a specific event, action, or procedure—whether occurring by chance or by design—and the controller must process the personal data of individuals to protect, safeguard, or pursue its legitimate interests. Since the processing of individuals’ personal data pursuant to point (f) of the first paragraph of Article 6 occurs exclusively as a result of the controller’s (unilateral and autonomous) decision, the requirements related to the principle of accountability must be correspondingly strict. The proportionality of personal data processing means, among other things, that the more autonomy the controller has in deciding on the processing of individuals’ personal data (or when, how, which data, and until when it will process them), and the more such processing is for the controller’s (direct) benefit, the more the controller must demonstrate its justification. This is, after all, also the difference between points (d) and (f) of the first paragraph of Article 6 of the General Data Protection Regulation, since the processing of personal data under the first point is in the individual’s interest, as it involves the protection of their vital interests—which is why no balancing is required—whereas in the second case, the balancing serves as a safeguard to prevent individuals’ personal data from being merely (mere, instrumental, and incidental) consequence of the controller’s interests. Given that an appropriate legal basis must be established prior to the actual processing of personal data (ex ante), the statements made by the supervised controller regarding the (im)possibility of objective reconstruction must be rejected, as they presuppose that lawfulness can be established “retrospectively” (ex post). This clearly follows from the first paragraph of Article 1 of the General Data Protection Regulation, which stipulates that this Regulation lays down rules on the protection of individuals with regard to the processing of personal data. In this context, the preposition “at” is used to indicate the point in time at which something occurs. Compliance with the processing of personal data must therefore be demonstrated at the very moment of processing. Likewise, the existence of a legal basis is not merely a factual question or an empirical fact— namely whether the circumstances exist in which a legitimate interest prevails over the rights of the individual, but rather a fundamental normative question or normative fact, as it involves the assessment of these circumstances. For this reason, prior to processing, it must be (cumulatively) established both the factual circumstances under which a specific processing of individuals’ personal data is necessary and a normative assessment must be conducted as to whether the existence of empirical circumstances justifies the processing of individuals’ personal data. Only both of these together make it possible to decide on the existence of the relevant legal basis. Consequently, this also defines the substance of the requirement of the principle of accountability. In a specific case, the essence of the principle of accountability must also be understood through the principles of transparency and fairness. The concrete nature of the legitimate interests test contributes to a more transparent demonstration of the lawfulness of the processing, since by ensuring that the legitimate interests test is concrete—that is, by making it part of empirical reality—transparency is ensured regarding what (legitimate interests and the processing of personal data), who (the controller and individuals), how (the process of balancing and processing personal data), when (the time of the balancing and processing of personal data), and why (the reasons why legitimate interests override the rights of individuals). This reduces the likelihood—or prevents—compliance from being ensured or attempted only after the processing has taken place. The fundamental purpose of the General Data Protection Regulation is to ensure lawful, fair, and transparent processing of personal data in advance, since the protection of individuals’ personal data would be merely superficial if compliance were ensured only after the fact. It is therefore essential that non-compliant processing of personal data does not occur in the first place and that initially non-compliant processing of personal data cannot be made compliant retroactively. In other words, and taking into account the principle of fairness, the lawfulness of (prior) processing of personal data cannot be justified by knowledge of (subsequent) consequences or results, as this introduces so-called post-hoc rationalization or bias due to subsequent knowledge into the assessment of necessity, which then unfairly influences the assessment itself. For the reasons stated above, when invoking this legal basis, it is very important that the controller, in determining the existence of this legal basis—both for its own purposes and for any subsequent review by the supervisory authority— ensure the possibility of an objective, factual, and comprehensive decision-making process regarding the existence of this legal basis at the time of the (specific) processing of personal data. With regard to the demonstration of the legality test, the supervised controller stated during the proceedings that the legal basis is the legitimate interest of the controller (employer) pursuant to point (f) of the first paragraph of Article 6 of the General Data Protection Regulation, namely to prevent business damage and ensure the smooth operation of the business. To demonstrate compliance with processing requirements, the controller submitted the minutes of the committee’s review of work-related email and the Rules on Procedures and Measures for the Protection of Personal Data of Company …. The IP notes that the submitted documents do not contain additional or more detailed provisions regarding the redirection of employees’ email, but they do contain provisions regarding access to email. It was only in its response to the request dated … that the supervised controller stated that it had conducted a legitimate interests test, how it had conducted it, and what circumstances it had taken into account in doing so. However, it did not submit any evidence to support the claim that the test in question was actually conducted on … or before or at the time the complainant’s email was redirected. Consequently, the timing of the legitimate interests test is unknown or cannot be verified. Consequently, in this case, the IP, as the supervisory authority, can only determine and assess whether the circumstances justifying the existence of this test were present; however, it cannot determine whether this test was actually conducted or when it was conducted. In the present case, apart from the statement by the supervised controller, the submitted documents or evidence do not demonstrate that this test was conducted, which gives rise to reasonable doubt as to whether it was actually conducted and when it was conducted. In accordance with general rules of evidence, the burden of proof lies with the party asserting the existence of a fact (Article 140 of the Administrative Procedure Act), and establishing a fact requires the highest degree of certainty (conviction), where there is no longer any doubt as to the reality of the situation. A decision may be made on the basis of facts proven by a preponderance of evidence—that is, with a lower standard of proof, where the evidence supporting a fact is stronger than that opposing it—only if so provided by law (second paragraph of Article 8 of the ZUP) or if the matter concerns urgent measures in the public interest (Article 144 of the ZUP). In the case at hand, the supervised controller failed to demonstrate that, prior to redirecting the complainant’s email, it had actually conducted a legitimate interests test, when it was conducted, or how it was conducted, thereby failing to comply with the principle of accountability regarding the lawfulness of personal data processing. The principle of accountability does not merely require the controller to assert the lawfulness of personal data processing; rather, the controller must also demonstrate the existence of objective, verifiable, and convincing facts that confirm the alleged lawfulness. How the controller achieves this is left to its discretion. The easiest way for the controller to fulfill this obligation is through written or electronic documentation of the processing of personal data. Failure to formalize the documentation of personal data processing does not in itself constitute a violation, but it does pose a risk that, during a supervisory procedure, the controller under review may find it more difficult to demonstrate compliance with personal data processing requirements, since, by its very nature, a supervisory procedure involves establishing past facts. For this reason, controllers are advised to document all procedures related to the processing of personal data on an ongoing basis, especially in cases where the legal basis for the processing of personal data is not predetermined by regulations or declarations of intent, but rather by specific circumstances that justify (unilateral) interventions in an individual’s right to the protection of personal data or the processing of individuals’ personal data without their knowledge. Without objective, factual, and convincing evidence, the IP cannot verify whether, in a specific case, the legitimate interests test was actually conducted, when it was carried out, how it was carried out, or which circumstances at that time indicated that the controller’s legitimate interests prevailed over the complainant’s interests and rights. For this reason, the IP considers that the supervised controller did not meet the requirements of the principle of accountability and, consequently, did not lawfully redirect or reroute the complainant’s emails, as it failed to demonstrate the existence of an appropriate legal basis for doing so, thereby violating the complainant’s right to the protection of personal data. Notwithstanding the failure to meet the formal condition for the processing of personal data under point (f) of the first paragraph of Article 6 of the General Data Protection Regulation, the IP further presents its findings regarding the substantive conditions. For this legal basis to exist, the following three cumulative conditions must be met: 1) the pursuit of a legitimate interest by the controller or a third party; 2) the processing of personal data must be necessary for the purposes of the legitimate interest pursued; and 3) the interests or fundamental rights and freedoms of the data subjects must not override the legitimate interests pursued by the controller or a third party. The data controller in question states that by redirecting the complainant’s email, it sought to ensure the smooth operation of its business and prevent business losses. In accordance with the case law of the CJEU (C‑621/22 — Koninklijke Nederlandse Lawn Tennisbond), a business or commercial interest may also be considered a legitimate interest; therefore, it must be established that the supervised controller pursued a legitimate interest by redirecting the complainant’s email. In the second step, it must be established that the specific processing of personal data is necessary for the purposes of the legitimate interest pursued. Necessity refers to the question of whether the legitimate interests cannot be achieved just as effectively through measures that are less restrictive of fundamental human rights and freedoms. If there are reasonable and equally effective, yet less restrictive, alternative measures, the processing of personal data is not considered necessary. The case law of the CJEU (e.g., C-26/22 and C-64/22) is restrictive with regard to the necessity of processing personal data, as processing is permissible only to the extent that it is strictly necessary for the purpose of legitimate interests. When assessing the necessity of processing, one does not merely assess the necessity of the processing as such, but also its individual aspects or elements. A finding regarding the necessity of processing does not (automatically) also determine its quantitative and qualitative aspects, which in turn directly affect the adequacy, relevance, and limited nature of the personal data (point (c) of the first paragraph of Article 5 of the General Data Protection Regulation), which are the subject of the processing. In this specific case, the necessity pertains both to the redirection of the complainant’s email itself and to the scope and duration of that redirection. The assessment of necessity therefore also addresses the question of whether, in order to achieve the legitimate interests pursued, the redirection of the complainant’s e-mail had to be carried out continuously from … to …. Based on the parties’ statements, the IP finds that, from … to …, the supervised controller redirected all emails addressed to the complainant to a shared email address, thereby enabling the receipt, monitoring, and review of all emails addressed to the complainant during that period. It should also be noted that the use of work email for personal purposes was not prohibited, and that the automatic out-of-office reply indicating the complainant’s absence and specifying the email address to which messages should be sent during that time had already been set up by the complainant himself. The supervised controller justifies the need for redirection by stating that, despite the complainant’s out-of-office reply, emails were still arriving at the complainant’sand that most of the data regarding business partners was stored at the complainant’s email address, which is why the administrator subsequently implemented a temporary redirection of the complainant’s email; this measure was, in substance, temporally, and organizationally limited. The complainant’s email was redirected to the email address …, which could only be accessed by the employee who was substituting for the complainant at that time. Based on the foregoing, the IP finds that the measure taken by the supervised controller was excessive in light of the nature of the complainant’s information privacy that was infringed, since not all less intrusive measures were utilized, and because, after accessing the complainant’s email and redirecting it to a shared email address, his mail continued to be redirected until the termination of his employment. The redirection of the complainant’s email was therefore not a temporary measure, but a permanent one, since the cessation of the redirection was not due to the fact that the supervised controller had safeguarded its legitimate interests in a different manner that less infringed upon information privacy, but rather due to the cancellation of the complainant’s email address as a result of the termination of his employment. The termination of the forwarding was thus an incidental and necessary consequence of a circumstance external to or incidental to the processing of personal data in question, and not the result of a decision directly related to the processing of personal data. The required necessity could have been established if it had been demonstrated that, throughout the entire period from … to …, no alternative measure was available other than the (permanent) forwarding of the complainant’s email. Likewise, the IP does not agree with the supervised controller that all less restrictive measures were exhausted. It is not apparent from the supervised controller’s statements that, upon concluding that the complainant’s automatic reply was insufficient, it set up its own automatic reply to notify senders of (the necessity of) sending messages to a different email address—just as it did after the termination of the employment relationship—and ceased redirecting the complainant’s email. Since the forwarding of an employee’s entire email constitutes a significant intrusion into an individual’s informational privacy, all reasonable and available means must first be exhausted, and the intrusion itself must be limited to the extent necessary to achieve the legitimate interests pursued. Since this was not the case here, the requirement of necessity is not met. Consequently, there is also no adequate legal basis, as the legitimate interests test does not satisfy all requirements—namely, the second condition. Since there was no necessity to process the complainant’s personal data in the manner and to the extent carried out by the supervised controller in order to achieve legitimate interests, not only was the principle of lawfulness violated, but also the principle of proportionality, as set forth in points (a) and (c) of the first paragraph of Article 5 and the first paragraph of Article 6 of the General Data Protection Regulation; consequently, the IP decided as set forth in the first point of the operative part. 5. Ordering of Measures and Dismissal of the Request Given that the processing of the complainant’s personal data ceased on …, and that the parties do not request or agree that additional measures are necessary, the IP has therefore decided in the second point of the operative part not to order the supervised controller to take any measures regarding the processing of personal data, as this would be both pointless and unnecessary. The application of the set of corrective measures under the second paragraph of Article 58 of the General Regulation is, in fact, also contingent upon the measure in question being necessary to ensure compliance with this Regulation (see point 48 of the reasoning in the Opinion of Advocate General Priit Pikamäe dated April 11, 2024, in Case C‑768/21, TR v. Land Hessen). With regard to the complainant’s claim—namely, the allegation of a violation concerning the unlawful access to email—the IP found that this was a one-time act that was fully completed prior to the filing of the complaint, and therefore the allegation of a violation does not meet the condition that the violation must (still) exist at the time the complaint was filed. Therefore, this part of the complaint must be dismissed, as stated in the third point of the operative part, since the judicial protection provided for under the third paragraph of Article 11 of the ZVOP-2 for determining violations established by the General Data Protection Regulation or by laws governing the processing or protection of personal data which have ceased to exist, the judicial protection provided for under the third paragraph of Article 11 of ZVOP-2 applies, meaning that the adjudication of such claims falls within the jurisdiction of the courts. This means that the circumstances set forth in point 1 of the first paragraph of Article 129 of the Administrative Procedure Act (ZUP) exist, and therefore this part of the claim must be dismissed, as stated in the third point of the operative part. The parties also agreed with the foregoing, and therefore no further explanation is necessary. 6. Permissible Scope of Review of the Case File Point 3 of the first paragraph of Article 34 of the ZVOP-2 stipulates that a decision in a supervisory proceeding under the provisions of this section must, in addition to the elements prescribed by the law governing general administrative procedure, must also include the permitted scope of access to the case file for a complainant with special status. The right to inspect the case file is one of the cornerstones of a party’s rights in proceedings, through which the principles of the protection of parties’ rights and the right to be heard are also realized. Given the importance and purpose of this right, its restriction is permissible only in exceptional or exhaustively defined cases. The General Administrative Procedure Act (ZUP) specifies the grounds on which the right to inspect the case file may be restricted, including records of a minor, persons requiring special protection, or other persons whose privacy would be disproportionately affected, the confidentiality of data, minutes of deliberations and voting, and draft decisions. Likewise, Article 23 of the General Regulation provides that the scope of the obligations and rights set forth in Articles 12 through 22 may be restricted by legislative measures if such a restriction respects the essence of fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to ensurein the qualified cases listed in points (a) through (j). Since the IP did not identify, in this specific case, any grounds that would justify a restriction on the right to inspect the case file, it did not restrict the complainant’s right to inspect the case file in the matter pending under No. … (fourth point of the operative part of the decision). 7. Costs of the Proceedings Pursuant to the first paragraph of Article 118 of the Administrative Procedure Act (ZUP), the authority shall, in its decision, rule on the costs of the proceedings, specifying who shall bear them, their amount, and to whom and by what deadline they must be paid. No special costs were incurred in these supervisory proceedings (fifth point of the operative part of the decision). The complainant and the supervised operator shall each bear their own costs that may have been incurred as a result of the proceedings (second paragraph of Article 30 of the Personal Data Protection Act-2). In accordance with point 23 of the first paragraph of Article 28 of the Administrative Fees Act (Official Gazette of the Republic of Slovenia, No. 106/10—official consolidated text, 14/15 – ZUUJFO, 84/15 – ZZelP-J, 32/16, 30/18 – ZKZaš, 189/20 – ZFRO, and 44/25 – ZDOsk-1B; hereinafter: ZUT), the application is exempt from fees. Since, in accordance with the provision of the third paragraph of Article 57 of the General Regulation, the performance of the tasks of any supervisory authority (including the handling of complaints lodged by an individual to whom the personal data referred to in point (f) of the first paragraph of Article 57 of the General Regulation relates) is, for the data subject, free of charge; and since, pursuant to the second paragraph of Article 55 of ZVOP-2, the supervisory authority exercises the powers and performs the duties set forth in the first paragraph of Article 55 of ZVOP-2, which include deciding on complaints filed by complainants in a special position, free of charge, this decision is also exempt from fees, notwithstanding the provisions of the ZUT. Information on legal remedies: No appeal is permitted against this decision; however, it is permissible to initiate administrative litigation. Administrative litigation is initiated by filing a complaint with the Administrative Court, Fajfarjeva 33, 1000 Ljubljana. The complaint must be filed within thirty days of the service of this decision, in writing directly with the aforementioned court, by certified mail, or orally for the record. If the complaint is sent by certified mail, it is deemed to have been received on time if it was posted on the last day of the deadline for filing the complaint. In addition to the original, a transcript, or a copy of this decision, the complaint must be accompanied by one transcript or copy of the complaint and its attachments for the defendant, and, if anyone else is affected by the decision, one for that person as well. …, State Supervisor for Personal Data Protection To be served: • … – in person (ZUP) • … – in person (ZUP)