IP (Slovenia) - 0603 30 2023 12: Difference between revisions

From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Slovenia |DPA-BG-Color= |DPAlogo=LogoSI.png |DPA_Abbrevation=IP |DPA_With_Country=IP (Slovenia) |Case_Number_Name=0603 30 2023 12 |ECLI= |Original_Source_Name_1=IP |Original_Source_Link_1=https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip |Original_Source_Language_1=Slovenian |Original_Source_Language__Code_1=SL |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=I...")
 
m (Added a sentence)
 
(4 intermediate revisions by 2 users not shown)
Line 67: Line 67:
}}
}}


The DPA issued a controller with a fine Under [[Article 83 GDPR#5a|Article 83(5)(a) GDPR]] for recording its employees at work and further publishing these recordings on a public website.
The DPA fined a controller €25,000 for the unlawful recording of its employees’ workspaces and for unlawfully making these recordings available online.


== English Summary ==
== English Summary ==


=== Facts ===
=== Facts ===
The controller at an unspecified date in the past, installed video cameras within its company premises. Some of the cameras were directly pointed at the workspaces of employees of the company. The cameras recorded employees at work and these recordings were accessible to the controller, the manager of the employees, via a mobile phone and also through a website.  
At an unspecified date in the past, the controller installed video cameras within its company premises. Some of the cameras were directly pointed at employees' workspaces. The cameras recorded employees at work and these recordings were accessible to the controller, the manager of the employees, via a mobile phone and also through a website.  


The data subjects were not able to access the recordings and the processing was not transparent. There was no clearly visible notice of the video recording in progress placed at the entrance to the workplace. The controller placed a notice on the video recording well within the premises in an obscure place.  
The data subjects were not able to access the recordings. There was no clearly visible notice of the video recording in progress placed at the entrance to the workplace. The controller placed a notice on the video recording well within the premises in an obscure place.  


The notice of video recording did not contain information on the consequences of the recording, the contact details of the controller, whether information was passed on to third parties nor any of the required information under [[Article 13 GDPR#1|Article 13(1) GDPR]]. Moreover, the notice lacked any link to a website where this information could then be found.
The notice of video recording did not contain information on the consequences of the recording, the contact details of the controller, whether information was passed on to third parties nor any of the required information under [[Article 13 GDPR#1|Article 13(1) GDPR]]. Moreover, the notice lacked any link to a website where this information could then be found.
The DPA then launched an ex officio procedure against the controller.


=== Holding ===
=== Holding ===
The Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec –IP) held accountable the manager of the company as the controller but also the company as a whole, as represented by the controller.  
The [[IP (Slovenia)|Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec –IP)]] held accountable the manager of the company as the controller but also the company as a whole, as represented by the controller.
IP held that the controller had violated Article 76(4) of the Slovenian GDPR implementation law (Zakon o varstvu osebnih podatkov (ZVOP-2)). This article clearly specifies requirements which a notice informing data subjects on video surveillance must contain such as the processing purposes.  
 
IP held that the controller had violated [https://pisrs.si/pregledPredpisa?id=ZAKO7959 Article 76(4) of the Slovenian GDPR implementation law (Zakon o varstvu osebnih podatkov (ZVOP-2))]. This article clearly specifies requirements which a notice informing data subjects on video surveillance must contain such as the processing purposes, telephone number or e-mail address or web address for the purposes of exercising the individual's rights in the field of personal data protection or information on specific effects of processing, in particular further processing. None of the requirements were complied with.


All of these requirements were not complied with by the controller and further the IP established that the sole purpose of the video recording was simply to surveil the employees. It stated that if the recording had been for a legitimate purpose such as ensuring the security of the premises, the employees and the business, much less invasive camera placing would have sufficed. The IP explains that cameras at the entrance to the building and at cashier registers would have been adequate. The IP posited that the mere monitoring of employees does not constitute a legitimate ground for processing.  
All of these requirements were not complied with by the controller and further the IP established that the sole purpose of the video recording was simply to surveil the employees. It stated that if the recording had been for a legitimate purpose such as ensuring the security of the premises, the employees and the business, much less invasive camera placing would have sufficed. The IP explains that cameras at the entrance to the building and at cashier registers would have been adequate. The IP posited that the mere monitoring of employees does not constitute a legitimate ground for processing.  


The transfer to the public website was seen to be in breach of Article 5(1)(a) and [[Article 6 GDPR#1|Article 6(1) GDPR]] as there was no lawful basis for it. The company was fined with €25,000 and the manager was fined €1,750.
The transfer to the public website was seen to be in breach of [[Article 5 GDPR|Article 5(1)(a)]] and [[Article 6 GDPR#1|Article 6(1) GDPR]] as there was no lawful basis for it. The company was fined with €25,000 and the manager was fined €1,750.


== Comment ==
== Comment ==

Latest revision as of 06:57, 22 October 2024

IP - 0603 30 2023 12
LogoSI.png
Authority: IP (Slovenia)
Jurisdiction: Slovenia
Relevant Law: Article 5(1)(a) GDPR
Article 6(1) GDPR
Article 13(1) GDPR
Article 83(5)(a) GDPR
Article 76(4) ZVOP-2
Type: Investigation
Outcome: Violation Found
Started:
Decided: 23.09.2024
Published: 16.10.2024
Fine: 25,000 EUR
Parties: n/a
National Case Number/Name: 0603 30 2023 12
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Slovenian
Original Source: IP (in SL)
Initial Contributor: ao

The DPA fined a controller €25,000 for the unlawful recording of its employees’ workspaces and for unlawfully making these recordings available online.

English Summary

Facts

At an unspecified date in the past, the controller installed video cameras within its company premises. Some of the cameras were directly pointed at employees' workspaces. The cameras recorded employees at work and these recordings were accessible to the controller, the manager of the employees, via a mobile phone and also through a website.

The data subjects were not able to access the recordings. There was no clearly visible notice of the video recording in progress placed at the entrance to the workplace. The controller placed a notice on the video recording well within the premises in an obscure place.

The notice of video recording did not contain information on the consequences of the recording, the contact details of the controller, whether information was passed on to third parties nor any of the required information under Article 13(1) GDPR. Moreover, the notice lacked any link to a website where this information could then be found.

The DPA then launched an ex officio procedure against the controller.

Holding

The Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec –IP) held accountable the manager of the company as the controller but also the company as a whole, as represented by the controller.

IP held that the controller had violated Article 76(4) of the Slovenian GDPR implementation law (Zakon o varstvu osebnih podatkov (ZVOP-2)). This article clearly specifies requirements which a notice informing data subjects on video surveillance must contain such as the processing purposes, telephone number or e-mail address or web address for the purposes of exercising the individual's rights in the field of personal data protection or information on specific effects of processing, in particular further processing. None of the requirements were complied with.

All of these requirements were not complied with by the controller and further the IP established that the sole purpose of the video recording was simply to surveil the employees. It stated that if the recording had been for a legitimate purpose such as ensuring the security of the premises, the employees and the business, much less invasive camera placing would have sufficed. The IP explains that cameras at the entrance to the building and at cashier registers would have been adequate. The IP posited that the mere monitoring of employees does not constitute a legitimate ground for processing.

The transfer to the public website was seen to be in breach of Article 5(1)(a) and Article 6(1) GDPR as there was no lawful basis for it. The company was fined with €25,000 and the manager was fined €1,750.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.

IP practice

+ -

In order to make the practice of the Information Commissioner easy and widely accessible, we will publish the following documents from our practice in open format (.odt) on this site. File packages will be updated on a monthly basis.

 

Inspection procedures

1. Inspection decisions

until February 2019 (download, file size: 1.13 MB, publication date: 15.02.2019) March 2019 (download, file size: 0.14 MB, publication date: 12.04.2019) April 2019 (download, file size: 0.72 MB, publication date : 05/14/2019) June 2019 (download, file size: 0.06 MB, publication date: 07/15/2019) July 2019 (download, file size: 0.06 MB, publication date: 08/14/2019) August 2019 (download, file size: 0.07 MB, publication date: 09/16/2019) October 2019 (download, file size: 0.37 MB, publication date: 11/15/2019) December 2019 (download, file size: 0.14 MB, publication date: 1/15/2020) February 2020 (download, file size: 0.06 MB, publication date: 3/15/2020) July 2020 (download, file size: 0.13 MB, publication date: 8/18/2020) August 2020 (download, file size: 0.07 MB, publication date: 9/15/2020) October 2020 (download, file size: 0.15 MB, publication date: 11/13/2020) November 2020 (download, file size: 0.45 MB, publication date: 12/15/2020) December 2020 (download, file size: 0.21 MB, publication date: 15:01 .2021) January 2021 (download, file size: 0.07 MB, publication date: 02/15/2021) March 2021 (download, file size: 0.53 MB, publication date: 04/15/2021) April 2021 (download, file size: 0.11 MB, publication date: 05/14/2021) May 2021 (download, file size: 0.90 MB, publication date: 06/15/2021) July 2021 (download, file size: 0.21 MB, publication date: 08/16/2021) August 2021 (download, file size : 0.23 MB, publication date: 09/15/2021) September 2021 (download, file size: 0.09 MB, publication date: 10/15/2021) January 2022 (download, file size: 0.06 MB, publication date: 02/15/2022) March 2022 ( downloads, file size: 0.28 MB, publication date: 04/15/2022) May 2022 (download, file size: 0.7 MB, publication date: 06/15/2022) June 2022 (download, file size: 0.11 MB, publication date : 15/07/2022) October 2022 (download, file size: 0.14 MB, publication date: 14/11/2022) 0613-66/2018/11 — GPS tracking by employer — GDPR restriction 58-2f November 2022 (download, size files: 0.08 MB, published date: 12/15/2022) January 2023 (download, file size: 0.09 MB, published date: 2/15/2023) August 2023 (download, file size: 0.19 MB, published date: 9/15/2023) September 2023 (Download, File Size: 3.05 MB, Publication Date: 10/13/2023) October 2023 (Download, File Size: 1.5 MB, Publication Date: 11/15/2023) November 2023 (Download, Size files: 1.24 MB, published date: 12/15/2023) December 2023 (download, file size: 0.26 MB, published date: 01/15/2024) January 2024 (download, file size: 0.24 MB, published date: 02/15/2024) February 2024 (Download, File Size: 0.43MB, Publication Date: 2024-03-15) April 2024 (Download, File Size: 0.01MB, Publication Date: 2024-05-15) May 2024 (Download, Size files: 0.90 MB, published date: 06/14/2024) June 2024 (download, file size: 0.32 MB, published date: 07/16/2024) July 2024 (download, file size: 0.43 MB, published date: 08/14/2024) 2024)

2. Decisions on suspension

until February 2019 (download, file size: 57.9 MB, publication date: 15.02.2019) February 2019 (download, file size: 1.5 MB, publication date: 15.3.2019) March 2019 (download, file size: 1.2 MB, publication date : 12/04/2019) April 2019 (download, file size: 1.0 MB, publication date: 14/05/2019) May 2019 (download, file size: 0.99 MB, publication date: 13/06/2019) June 2019 (download, file size: 2.68 MB, publication date: 15.07.2019) July 2019 (download, file size: 1.6 MB, publication date: 14.08.2019) August 2019 (download, file size: 3.7 MB, publication date: 16.09.2019) September 2019 (download, file size: 3.39 MB, publication date: 10/15/2019) October 2019 (download, file size: 3.48 MB, publication date: 11/15/2019) November 2019 (download, file size: 1.19 MB, publication date: 12/16/2019) December 2019 (download, file size: 3.68 MB, publication date: 15.1.2020) January 2020 (download, file size: 2.92 MB, publication date: 14.2.2020) February 2020 (download, file size: 2.70 MB, publication date: 15.3 .2020) March 2020 (Download, File Size: 1.10 MB, Publication Date: 20/05/2020) June 2020 (Download, File Size: 7.66 MB, Publication Date: 15/07/2020) July 2020 (Download, File Size: 3.55 MB, publication date: 8/18/2020) August 2020 (download, file size: 4.25 MB, publication date: 9/15/2020) September 2020 (download, file size: 4.60 MB, publication date: 10/15/2020) October 2020 (download, file size : 3.61 MB, publication date: 11/13/2020) November 2020 (download, file size: 5.7 MB, publication date: 12/15/2020) December 2020 (download, file size: 4.4 MB, publication date: 01/15/2021) January 2021 ( downloads, file size: 4.6 MB, publication date: 15/02/2021) February 2021 (downloads, file size: 2.3 MB, publication date: 15/03/2021) March 2021 (downloads, file size: 3.30 MB, publication date: 15/04/2021 ) April 2021 (download, file size: 2.70 MB, publication date: 14.05.2021) May 2021 (download, file size: 6.23 MB, publication date: 15.06.2021) June 2021 (download, file size: 2.35 MB, publication date : 15.07.2021) July 2021 (download, file size: 1.56 MB, publication date: 16.08.2021) August 2021 (download, file size: 2.28 MB, publication date: 16.09.2021) September 2021 (download, file size: 1.26 MB, publication date: 15.10.2021) October 2021 (download, file size: 2.82 MB, publication date: 15.11.2021) December 2021 (download, file size: 0.56 MB, publication date: 14.01.2022)

3. Decisions and resolutions according to Article 41 of ZVOP-2

August 2023 (Download, File Size: 0.91 MB, Publication Date: 10/16/2023) October 2023 (Download, File Size: 0.73 MB, Publication Date: 11/15/2023)

Offense procedures

1. Decisions on offences 

to February 2019 (download, file size: 16.2 MB, publication date: 15/02/2019) February 2019 (download, file size: 0.2 MB, publication date: 15/03/2019) March 2019 (download, file size: 0.25 MB, publication date: 04/12/2019) April 2019 (download, file size: 0.37 MB, publication date 05/14/2019) May 2019 (download, file size: 0.75 MB, publication date 06/13/2019) June 2019 ( downloads, file size: 0.26 MB, publication date 07/15/2019) July 2019 (downloads, file size: 1.6 MB, publication date 08/14/2019) August 2019 (downloads, file size: 0.14 MB, publication date 16/09/2019) September 2019 (Download, file size: 1.10 MB, publication date: 15/10/2019) October 2019 (download, file size: 0.92 MB, publication date: 15/11/2019) December 2019 (download, size files: 0.06 MB, published date: 01/15/2020) January 2020 (download, file size: 0.18 MB, published date: 2/14/2020) February 2020 (download, file size: 0.43 MB, published date: 3/15/2020) March 2020 (download, file size: 1.35 MB, publication date: 5/20/2020) June 2020 (download, file size: 0.19 MB, publication date 7/15/2020) July 2020 (download, file size: 0.70 MB, publication date 8/18/2020) August 2020 (download, file size: 0.57 MB, publication date: 9/15/2020) September 2020 (download, file size: 0.18 MB, publication date: 10/15/2020) October 2020 (download, file size: 0.19 MB, publication date: 11/13/2020) November 2020 (download, file size: 0.82 MB, publication date: 12/15/2020) December 2020 (download, file size: 0.19 MB, publication date: 01/15/2021) January 2021 (download , file size: 0.2 MB, publication date: 02/15/2021) March 2021 (download, file size: 0.05 MB, publication date: 04/15/2021) April 2021 (download, file size: 0.28 MB, publication date: 05/14/2021) June 2021 (download, file size: 0.61 MB, publication date: 15/07/2021) July 2021 (download, file size: 0.16 MB, publication date: 16/08/2021) August 2021 (download, file size: 0.15 MB, publication date: 15/09/2021) September 2021 (download, file size: 0.35 MB, publication date: 15/10/2021) October 2021 (download, file size: 0.36 MB, publication date: 15/11/2021) November 2021 (download, file size: 0.26 MB , publication date: 15/12/2021) December 2021 (download, file size: 0.63 MB, publication date: 14/01/2022) January 2022 (download, file size: 0.06 MB, publication date: 15/02/2022) February 2022 (download, size files: 0.29 MB, publication date: 16/03/2022) March 2022 (download, file size: 0.97 MB, publication date: 15/04/2022) April 2022 (download, file size: 0.68 MB, publication date: 15/05/2022) May 2022 (download, file size: 0.45 MB, publication date: 2022-06-15) June 2022 (download, file size: 0.94 MB, publication date: 2022-07-15) August 2022 (download, file size: 0.13 MB) , publication date: 09/15/2022) September 2022 (download, file size: 0.33 MB, publication date: 10/15/2022) October 2022 (download, file size: 0.71 MB, publication date: 11/14/2022) November 2022 (download, file size: 0.48 MB, published date: 15/12/2022) December 2022 (download, file size: 0.25 MB, published date: 16/01/2023) January 2023 (download, file size: 0.57 MB) , publication date: 2023-02-15) February 2023 (download, file size: 0.17 MB, publication date: 2023-03-15) March 2023 (download, file size: 0.26 MB, publication date: 2023-04-14) April 2023 (download, file size: 0.10 MB, publication date: 2023-05-15) May 2023 (download, file size: 0.70 MB, publication date: 2023-06-15) June 2023 (download, file size: 0.40 MB) , publication date: 07/14/2023) August 2023 (download, file size: 0.16 MB, publication date: 09/15/2023) September 2023 (download, file size: 0.17 MB, publication date: 10/15/2023) October 2023 (Download, File Size: 0.80 MB, Publish Date: 2023-11-15) November 2023 (Download, File Size: 0.16 MB, Publish Date: 2023-12-15) December 2023 (Download, File Size: 0.27 MB) , publication date: 2024-01-15) January 2024 (download, file size: 0.68 MB, publication date: 2024-02-15) March 2024 (download, file size: 0.17 MB, publication date: 2024-04-15) April 2024 (download, file size: 0.34 MB, publication date: 2024-05-15) May 2024 (download, file size: 0.15 MB, publication date: 2024-06-14) June 2024 (download, file size: 0.28 MB) , publication date: 2024-07-16) September 2024 (download, file size: 0.14 MB, publication date: 2024-10-16)

 

2. Decisions on suspension

3. Official endorsements 

 

Non-binding opinions

1. Opinions (download, file size: 91.3 MB, publication date: 15.02.2019)

2. All opinions submitted online after 1 January 2019 are available on our website.

 

Conditions for re-use of public information

The Information Commissioner's practices in the above files may be reused by anyone for commercial or other purposes free of charge, provided that:

1. data reuse is carried out in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) and the law governing the protection of personal data and

2. every time it is reused, it indicates the source of the data (license CC BY 4.0.).

to February 2019 (download, file size: 5.2 MB, publication date: 15/02/2019) to February 2019 (download, file size: 0.11 MB, publication date: 16/03/2019) May 2021 (download, file size: 0.57 MB, date published: 15/06/2021)