IP (Slovenia) - 0603 30 2023 12: Difference between revisions
From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Slovenia |DPA-BG-Color= |DPAlogo=LogoSI.png |DPA_Abbrevation=IP |DPA_With_Country=IP (Slovenia) |Case_Number_Name=0603 30 2023 12 |ECLI= |Original_Source_Name_1=IP |Original_Source_Link_1=https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip |Original_Source_Language_1=Slovenian |Original_Source_Language__Code_1=SL |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=I...") |
m (Added a sentence) |
||
| (4 intermediate revisions by 2 users not shown) | |||
| Line 67: | Line 67: | ||
}} | }} | ||
The DPA | The DPA fined a controller €25,000 for the unlawful recording of its employees’ workspaces and for unlawfully making these recordings available online. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
At an unspecified date in the past, the controller installed video cameras within its company premises. Some of the cameras were directly pointed at employees' workspaces. The cameras recorded employees at work and these recordings were accessible to the controller, the manager of the employees, via a mobile phone and also through a website. | |||
The data subjects were not able to access the recordings | The data subjects were not able to access the recordings. There was no clearly visible notice of the video recording in progress placed at the entrance to the workplace. The controller placed a notice on the video recording well within the premises in an obscure place. | ||
The notice of video recording did not contain information on the consequences of the recording, the contact details of the controller, whether information was passed on to third parties nor any of the required information under [[Article 13 GDPR#1|Article 13(1) GDPR]]. Moreover, the notice lacked any link to a website where this information could then be found. | The notice of video recording did not contain information on the consequences of the recording, the contact details of the controller, whether information was passed on to third parties nor any of the required information under [[Article 13 GDPR#1|Article 13(1) GDPR]]. Moreover, the notice lacked any link to a website where this information could then be found. | ||
The DPA then launched an ex officio procedure against the controller. | |||
=== Holding === | === Holding === | ||
The Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec –IP) held accountable the manager of the company as the controller but also the company as a whole, as represented by the controller. | The [[IP (Slovenia)|Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec –IP)]] held accountable the manager of the company as the controller but also the company as a whole, as represented by the controller. | ||
IP held that the controller had violated Article 76(4) of the Slovenian GDPR implementation law (Zakon o varstvu osebnih podatkov (ZVOP-2)). This article clearly specifies requirements which a notice informing data subjects on video surveillance must contain such as the processing purposes. | |||
IP held that the controller had violated [https://pisrs.si/pregledPredpisa?id=ZAKO7959 Article 76(4) of the Slovenian GDPR implementation law (Zakon o varstvu osebnih podatkov (ZVOP-2))]. This article clearly specifies requirements which a notice informing data subjects on video surveillance must contain such as the processing purposes, telephone number or e-mail address or web address for the purposes of exercising the individual's rights in the field of personal data protection or information on specific effects of processing, in particular further processing. None of the requirements were complied with. | |||
All of these requirements were not complied with by the controller and further the IP established that the sole purpose of the video recording was simply to surveil the employees. It stated that if the recording had been for a legitimate purpose such as ensuring the security of the premises, the employees and the business, much less invasive camera placing would have sufficed. The IP explains that cameras at the entrance to the building and at cashier registers would have been adequate. The IP posited that the mere monitoring of employees does not constitute a legitimate ground for processing. | All of these requirements were not complied with by the controller and further the IP established that the sole purpose of the video recording was simply to surveil the employees. It stated that if the recording had been for a legitimate purpose such as ensuring the security of the premises, the employees and the business, much less invasive camera placing would have sufficed. The IP explains that cameras at the entrance to the building and at cashier registers would have been adequate. The IP posited that the mere monitoring of employees does not constitute a legitimate ground for processing. | ||
The transfer to the public website was seen to be in breach of Article 5(1)(a) and [[Article 6 GDPR#1|Article 6(1) GDPR]] as there was no lawful basis for it. The company was fined with €25,000 and the manager was fined €1,750. | The transfer to the public website was seen to be in breach of [[Article 5 GDPR|Article 5(1)(a)]] and [[Article 6 GDPR#1|Article 6(1) GDPR]] as there was no lawful basis for it. The company was fined with €25,000 and the manager was fined €1,750. | ||
== Comment == | == Comment == | ||
Latest revision as of 06:57, 22 October 2024
| IP - 0603 30 2023 12 | |
|---|---|
 | |
| Authority: | IP (Slovenia) |
| Jurisdiction: | Slovenia |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1) GDPR Article 13(1) GDPR Article 83(5)(a) GDPR Article 76(4) ZVOP-2 |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 23.09.2024 |
| Published: | 16.10.2024 |
| Fine: | 25,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 0603 30 2023 12 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Slovenian |
| Original Source: | IP (in SL) |
| Initial Contributor: | ao |
The DPA fined a controller €25,000 for the unlawful recording of its employees’ workspaces and for unlawfully making these recordings available online.
English Summary
Facts
At an unspecified date in the past, the controller installed video cameras within its company premises. Some of the cameras were directly pointed at employees' workspaces. The cameras recorded employees at work and these recordings were accessible to the controller, the manager of the employees, via a mobile phone and also through a website.
The data subjects were not able to access the recordings. There was no clearly visible notice of the video recording in progress placed at the entrance to the workplace. The controller placed a notice on the video recording well within the premises in an obscure place.
The notice of video recording did not contain information on the consequences of the recording, the contact details of the controller, whether information was passed on to third parties nor any of the required information under Article 13(1) GDPR. Moreover, the notice lacked any link to a website where this information could then be found.
The DPA then launched an ex officio procedure against the controller.
Holding
The Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec –IP) held accountable the manager of the company as the controller but also the company as a whole, as represented by the controller.
IP held that the controller had violated Article 76(4) of the Slovenian GDPR implementation law (Zakon o varstvu osebnih podatkov (ZVOP-2)). This article clearly specifies requirements which a notice informing data subjects on video surveillance must contain such as the processing purposes, telephone number or e-mail address or web address for the purposes of exercising the individual's rights in the field of personal data protection or information on specific effects of processing, in particular further processing. None of the requirements were complied with.
All of these requirements were not complied with by the controller and further the IP established that the sole purpose of the video recording was simply to surveil the employees. It stated that if the recording had been for a legitimate purpose such as ensuring the security of the premises, the employees and the business, much less invasive camera placing would have sufficed. The IP explains that cameras at the entrance to the building and at cashier registers would have been adequate. The IP posited that the mere monitoring of employees does not constitute a legitimate ground for processing.
The transfer to the public website was seen to be in breach of Article 5(1)(a) and Article 6(1) GDPR as there was no lawful basis for it. The company was fined with €25,000 and the manager was fined €1,750.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
IP practice + - In order to make the practice of the Information Commissioner easy and widely accessible, we will publish the following documents from our practice in open format (.odt) on this site. File packages will be updated on a monthly basis. Inspection procedures 1. Inspection decisions until February 2019 (download, file size: 1.13 MB, publication date: 15.02.2019) March 2019 (download, file size: 0.14 MB, publication date: 12.04.2019) April 2019 (download, file size: 0.72 MB, publication date : 05/14/2019) June 2019 (download, file size: 0.06 MB, publication date: 07/15/2019) July 2019 (download, file size: 0.06 MB, publication date: 08/14/2019) August 2019 (download, file size: 0.07 MB, publication date: 09/16/2019) October 2019 (download, file size: 0.37 MB, publication date: 11/15/2019) December 2019 (download, file size: 0.14 MB, publication date: 1/15/2020) February 2020 (download, file size: 0.06 MB, publication date: 3/15/2020) July 2020 (download, file size: 0.13 MB, publication date: 8/18/2020) August 2020 (download, file size: 0.07 MB, publication date: 9/15/2020) October 2020 (download, file size: 0.15 MB, publication date: 11/13/2020) November 2020 (download, file size: 0.45 MB, publication date: 12/15/2020) December 2020 (download, file size: 0.21 MB, publication date: 15:01 .2021) January 2021 (download, file size: 0.07 MB, publication date: 02/15/2021) March 2021 (download, file size: 0.53 MB, publication date: 04/15/2021) April 2021 (download, file size: 0.11 MB, publication date: 05/14/2021) May 2021 (download, file size: 0.90 MB, publication date: 06/15/2021) July 2021 (download, file size: 0.21 MB, publication date: 08/16/2021) August 2021 (download, file size : 0.23 MB, publication date: 09/15/2021) September 2021 (download, file size: 0.09 MB, publication date: 10/15/2021) January 2022 (download, file size: 0.06 MB, publication date: 02/15/2022) March 2022 ( downloads, file size: 0.28 MB, publication date: 04/15/2022) May 2022 (download, file size: 0.7 MB, publication date: 06/15/2022) June 2022 (download, file size: 0.11 MB, publication date : 15/07/2022) October 2022 (download, file size: 0.14 MB, publication date: 14/11/2022) 0613-66/2018/11 — GPS tracking by employer — GDPR restriction 58-2f November 2022 (download, size files: 0.08 MB, published date: 12/15/2022) January 2023 (download, file size: 0.09 MB, published date: 2/15/2023) August 2023 (download, file size: 0.19 MB, published date: 9/15/2023) September 2023 (Download, File Size: 3.05 MB, Publication Date: 10/13/2023) October 2023 (Download, File Size: 1.5 MB, Publication Date: 11/15/2023) November 2023 (Download, Size files: 1.24 MB, published date: 12/15/2023) December 2023 (download, file size: 0.26 MB, published date: 01/15/2024) January 2024 (download, file size: 0.24 MB, published date: 02/15/2024) February 2024 (Download, File Size: 0.43MB, Publication Date: 2024-03-15) April 2024 (Download, File Size: 0.01MB, Publication Date: 2024-05-15) May 2024 (Download, Size files: 0.90 MB, published date: 06/14/2024) June 2024 (download, file size: 0.32 MB, published date: 07/16/2024) July 2024 (download, file size: 0.43 MB, published date: 08/14/2024) 2024) 2. Decisions on suspension until February 2019 (download, file size: 57.9 MB, publication date: 15.02.2019) February 2019 (download, file size: 1.5 MB, publication date: 15.3.2019) March 2019 (download, file size: 1.2 MB, publication date : 12/04/2019) April 2019 (download, file size: 1.0 MB, publication date: 14/05/2019) May 2019 (download, file size: 0.99 MB, publication date: 13/06/2019) June 2019 (download, file size: 2.68 MB, publication date: 15.07.2019) July 2019 (download, file size: 1.6 MB, publication date: 14.08.2019) August 2019 (download, file size: 3.7 MB, publication date: 16.09.2019) September 2019 (download, file size: 3.39 MB, publication date: 10/15/2019) October 2019 (download, file size: 3.48 MB, publication date: 11/15/2019) November 2019 (download, file size: 1.19 MB, publication date: 12/16/2019) December 2019 (download, file size: 3.68 MB, publication date: 15.1.2020) January 2020 (download, file size: 2.92 MB, publication date: 14.2.2020) February 2020 (download, file size: 2.70 MB, publication date: 15.3 .2020) March 2020 (Download, File Size: 1.10 MB, Publication Date: 20/05/2020) June 2020 (Download, File Size: 7.66 MB, Publication Date: 15/07/2020) July 2020 (Download, File Size: 3.55 MB, publication date: 8/18/2020) August 2020 (download, file size: 4.25 MB, publication date: 9/15/2020) September 2020 (download, file size: 4.60 MB, publication date: 10/15/2020) October 2020 (download, file size : 3.61 MB, publication date: 11/13/2020) November 2020 (download, file size: 5.7 MB, publication date: 12/15/2020) December 2020 (download, file size: 4.4 MB, publication date: 01/15/2021) January 2021 ( downloads, file size: 4.6 MB, publication date: 15/02/2021) February 2021 (downloads, file size: 2.3 MB, publication date: 15/03/2021) March 2021 (downloads, file size: 3.30 MB, publication date: 15/04/2021 ) April 2021 (download, file size: 2.70 MB, publication date: 14.05.2021) May 2021 (download, file size: 6.23 MB, publication date: 15.06.2021) June 2021 (download, file size: 2.35 MB, publication date : 15.07.2021) July 2021 (download, file size: 1.56 MB, publication date: 16.08.2021) August 2021 (download, file size: 2.28 MB, publication date: 16.09.2021) September 2021 (download, file size: 1.26 MB, publication date: 15.10.2021) October 2021 (download, file size: 2.82 MB, publication date: 15.11.2021) December 2021 (download, file size: 0.56 MB, publication date: 14.01.2022) 3. Decisions and resolutions according to Article 41 of ZVOP-2 August 2023 (Download, File Size: 0.91 MB, Publication Date: 10/16/2023) October 2023 (Download, File Size: 0.73 MB, Publication Date: 11/15/2023) Offense procedures 1. Decisions on offences to February 2019 (download, file size: 16.2 MB, publication date: 15/02/2019) February 2019 (download, file size: 0.2 MB, publication date: 15/03/2019) March 2019 (download, file size: 0.25 MB, publication date: 04/12/2019) April 2019 (download, file size: 0.37 MB, publication date 05/14/2019) May 2019 (download, file size: 0.75 MB, publication date 06/13/2019) June 2019 ( downloads, file size: 0.26 MB, publication date 07/15/2019) July 2019 (downloads, file size: 1.6 MB, publication date 08/14/2019) August 2019 (downloads, file size: 0.14 MB, publication date 16/09/2019) September 2019 (Download, file size: 1.10 MB, publication date: 15/10/2019) October 2019 (download, file size: 0.92 MB, publication date: 15/11/2019) December 2019 (download, size files: 0.06 MB, published date: 01/15/2020) January 2020 (download, file size: 0.18 MB, published date: 2/14/2020) February 2020 (download, file size: 0.43 MB, published date: 3/15/2020) March 2020 (download, file size: 1.35 MB, publication date: 5/20/2020) June 2020 (download, file size: 0.19 MB, publication date 7/15/2020) July 2020 (download, file size: 0.70 MB, publication date 8/18/2020) August 2020 (download, file size: 0.57 MB, publication date: 9/15/2020) September 2020 (download, file size: 0.18 MB, publication date: 10/15/2020) October 2020 (download, file size: 0.19 MB, publication date: 11/13/2020) November 2020 (download, file size: 0.82 MB, publication date: 12/15/2020) December 2020 (download, file size: 0.19 MB, publication date: 01/15/2021) January 2021 (download , file size: 0.2 MB, publication date: 02/15/2021) March 2021 (download, file size: 0.05 MB, publication date: 04/15/2021) April 2021 (download, file size: 0.28 MB, publication date: 05/14/2021) June 2021 (download, file size: 0.61 MB, publication date: 15/07/2021) July 2021 (download, file size: 0.16 MB, publication date: 16/08/2021) August 2021 (download, file size: 0.15 MB, publication date: 15/09/2021) September 2021 (download, file size: 0.35 MB, publication date: 15/10/2021) October 2021 (download, file size: 0.36 MB, publication date: 15/11/2021) November 2021 (download, file size: 0.26 MB , publication date: 15/12/2021) December 2021 (download, file size: 0.63 MB, publication date: 14/01/2022) January 2022 (download, file size: 0.06 MB, publication date: 15/02/2022) February 2022 (download, size files: 0.29 MB, publication date: 16/03/2022) March 2022 (download, file size: 0.97 MB, publication date: 15/04/2022) April 2022 (download, file size: 0.68 MB, publication date: 15/05/2022) May 2022 (download, file size: 0.45 MB, publication date: 2022-06-15) June 2022 (download, file size: 0.94 MB, publication date: 2022-07-15) August 2022 (download, file size: 0.13 MB) , publication date: 09/15/2022) September 2022 (download, file size: 0.33 MB, publication date: 10/15/2022) October 2022 (download, file size: 0.71 MB, publication date: 11/14/2022) November 2022 (download, file size: 0.48 MB, published date: 15/12/2022) December 2022 (download, file size: 0.25 MB, published date: 16/01/2023) January 2023 (download, file size: 0.57 MB) , publication date: 2023-02-15) February 2023 (download, file size: 0.17 MB, publication date: 2023-03-15) March 2023 (download, file size: 0.26 MB, publication date: 2023-04-14) April 2023 (download, file size: 0.10 MB, publication date: 2023-05-15) May 2023 (download, file size: 0.70 MB, publication date: 2023-06-15) June 2023 (download, file size: 0.40 MB) , publication date: 07/14/2023) August 2023 (download, file size: 0.16 MB, publication date: 09/15/2023) September 2023 (download, file size: 0.17 MB, publication date: 10/15/2023) October 2023 (Download, File Size: 0.80 MB, Publish Date: 2023-11-15) November 2023 (Download, File Size: 0.16 MB, Publish Date: 2023-12-15) December 2023 (Download, File Size: 0.27 MB) , publication date: 2024-01-15) January 2024 (download, file size: 0.68 MB, publication date: 2024-02-15) March 2024 (download, file size: 0.17 MB, publication date: 2024-04-15) April 2024 (download, file size: 0.34 MB, publication date: 2024-05-15) May 2024 (download, file size: 0.15 MB, publication date: 2024-06-14) June 2024 (download, file size: 0.28 MB) , publication date: 2024-07-16) September 2024 (download, file size: 0.14 MB, publication date: 2024-10-16) 2. Decisions on suspension 3. Official endorsements Non-binding opinions 1. Opinions (download, file size: 91.3 MB, publication date: 15.02.2019) 2. All opinions submitted online after 1 January 2019 are available on our website. Conditions for re-use of public information The Information Commissioner's practices in the above files may be reused by anyone for commercial or other purposes free of charge, provided that: 1. data reuse is carried out in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) and the law governing the protection of personal data and 2. every time it is reused, it indicates the source of the data (license CC BY 4.0.). to February 2019 (download, file size: 5.2 MB, publication date: 15/02/2019) to February 2019 (download, file size: 0.11 MB, publication date: 16/03/2019) May 2021 (download, file size: 0.57 MB, date published: 15/06/2021)
