IP (Slovenia) - 07100-15-2023-1: Difference between revisions
No edit summary |
mNo edit summary |
||
| Line 63: | Line 63: | ||
}} | }} | ||
The controller, a Slovenian Ministry, was found to have infringed [[Article 15 GDPR|Article 15 GDPR]] in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 ZVOP-2] since, at the time of the | The controller, a Slovenian Ministry, was found to have infringed [[Article 15 GDPR|Article 15 GDPR]] in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 ZVOP-2] since, at the time of the data subject's complaint with the Slovenian DPA, it did not fully comply with the complainant’s access request. | ||
== English Summary == | == English Summary == | ||
| Line 76: | Line 76: | ||
Following this, the DPA asked the complainant if she wanted to pursue the complaint, to which she replied that not all the documents she had requested and wished to receive were given to her. In this respect, the controller clarified to the DPA that it did provide all the documents in its possession but wanted to check again for further documents. After the review, it did not find any further documents. | Following this, the DPA asked the complainant if she wanted to pursue the complaint, to which she replied that not all the documents she had requested and wished to receive were given to her. In this respect, the controller clarified to the DPA that it did provide all the documents in its possession but wanted to check again for further documents. After the review, it did not find any further documents. | ||
On 2 October 2023, the DPA informed the complainant of the controller’s reply, which the complainant did not comment. | On 2 October 2023, the DPA again informed the complainant of the controller’s reply, which the complainant did not comment. | ||
=== Holding === | === Holding === | ||
On the basis of the information provided, the Slovenian DPA concluded that the controller failed to take an appropriate decision on the complainant's access request to personal data at the time of the application, breaching [[Article 15 GDPR|Article 15 GDPR]] in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 ZVOP-2]. | On the basis of the information provided, the Slovenian DPA concluded that the controller failed to take an appropriate decision on the complainant's access request to personal data at the time of the application, breaching [[Article 15 GDPR|Article 15 GDPR]] in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 ZVOP-2]. | ||
The DPA noted that the controller did not provide copies of the documents but only a list of the documents, which the controller justified by explaining that the requested documents were already in the possession of the complainant. Thus, the DPA stressed that the mere fact that an individual already possesses the personal data asked to the controller does not constitute a valid reason for refusing an access request. Therefore, the controller failed to comply with [[Article 15 GDPR#3|Article 15(3) GDPR]], which provides that the data subject has the right to a copy of the personal data processed. | The DPA noted that the controller did not provide copies of the documents but only a list of the documents, which the controller justified by explaining that the requested documents were already in the possession of the complainant. Thus, the DPA stressed that the mere fact that an individual already possesses the personal data asked to the controller does not constitute a valid reason for refusing an access request. Therefore, at the time of the data subject's complaint, the controller failed to comply with [[Article 15 GDPR#3|Article 15(3) GDPR]], which provides that the data subject has the right to a copy of the personal data processed. | ||
Nonetheless, the DPA took into consideration the controller’s collaboration throughout the proceeding. Considering that the complainant also did not respond to the DPA's note of 2 October 2023, the DPA concluded that the controller had remedied the breach of the right of access by providing the complainant with all the documents it possessed containing the complainant's personal data, and decided that no specific measures were needed. | Nonetheless, the DPA took into consideration the controller’s collaboration throughout the proceeding. Considering that the complainant also did not respond to the DPA's note of 2 October 2023, the DPA concluded that the controller had remedied the breach of the right of access by providing the complainant with all the documents it possessed containing the complainant's personal data, and decided that no specific measures were needed. | ||
Revision as of 10:35, 24 January 2024
| IP - 07100-15-2023-1 | |
|---|---|
 | |
| Authority: | IP (Slovenia) |
| Jurisdiction: | Slovenia |
| Relevant Law: | Article 15 GDPR Article 12 ZVOP-2 Article 14 ZVOP-2 |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 29.11.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 07100-15-2023-1 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Slovenian |
| Original Source: | Informacijski pooblaščenec (in SL) |
| Initial Contributor: | ar |
The controller, a Slovenian Ministry, was found to have infringed Article 15 GDPR in conjunction with Articles 12 and 14 ZVOP-2 since, at the time of the data subject's complaint with the Slovenian DPA, it did not fully comply with the complainant’s access request.
English Summary
Facts
On 26 May 2023, the complainant, a public servant, submitted an access request to its former employer, a Slovenian Ministry, (the controller) to obtain copies of all the documents held on her. The controller partially complied with the request and provided the complainant with a list of all the documents it kept. However, it explained that it would not send copies of the documents since the complainant should already be in their possession.
Following the controller’s reply, on 3 July 2023, the complainant lodged a complaint with the Slovenian DPA because only part of the documents requested by her were granted.
The DPA found the complaint well-founded and issued a statement with preliminary findings, highlighting that the controller had unjustifiably partially refused the applicant's access request and provided the controller with the possibility to reconsider the complainant’s request. Thus, the controller, considering the DPA’s position, granted the complainant’s access request and sent her copies of the documents highlighted in the list first sent to her.
Following this, the DPA asked the complainant if she wanted to pursue the complaint, to which she replied that not all the documents she had requested and wished to receive were given to her. In this respect, the controller clarified to the DPA that it did provide all the documents in its possession but wanted to check again for further documents. After the review, it did not find any further documents.
On 2 October 2023, the DPA again informed the complainant of the controller’s reply, which the complainant did not comment.
Holding
On the basis of the information provided, the Slovenian DPA concluded that the controller failed to take an appropriate decision on the complainant's access request to personal data at the time of the application, breaching Article 15 GDPR in conjunction with Articles 12 and 14 ZVOP-2.
The DPA noted that the controller did not provide copies of the documents but only a list of the documents, which the controller justified by explaining that the requested documents were already in the possession of the complainant. Thus, the DPA stressed that the mere fact that an individual already possesses the personal data asked to the controller does not constitute a valid reason for refusing an access request. Therefore, at the time of the data subject's complaint, the controller failed to comply with Article 15(3) GDPR, which provides that the data subject has the right to a copy of the personal data processed.
Nonetheless, the DPA took into consideration the controller’s collaboration throughout the proceeding. Considering that the complainant also did not respond to the DPA's note of 2 October 2023, the DPA concluded that the controller had remedied the breach of the right of access by providing the complainant with all the documents it possessed containing the complainant's personal data, and decided that no specific measures were needed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
