IP (Slovenia) - 07100-15-2023-1: Difference between revisions
No edit summary |
No edit summary |
||
| (2 intermediate revisions by 2 users not shown) | |||
| Line 63: | Line 63: | ||
}} | }} | ||
The controller, a Slovenian Ministry, was found to have infringed [[Article 15 GDPR|Article 15 GDPR]] in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 | The controller, a Slovenian Ministry, was found to have infringed [[Article 15 GDPR|Article 15 GDPR]] in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 of the Slovenian Data Protection Act] since, at the time of the data subject's complaint with the Slovenian DPA, it did not fully comply with the complainant’s access request. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
On 26 May 2023, the complainant, a public servant, submitted an access request to | On 26 May 2023, the complainant, a public servant, submitted an access request to its former employer, a Slovenian Ministry, (the controller) to obtain copies of all the documents held on her. The controller partially complied with the request and provided the complainant with a list of all the documents it kept. However, it explained that it would not send copies of the documents since the complainant should already be in their possession. | ||
Following the controller’s reply, on 3 July 2023, the complainant lodged a complaint with the Slovenian DPA because only part of the documents requested by her were granted. | Following the controller’s reply, on 3 July 2023, the complainant lodged a complaint with the Slovenian DPA because only part of the documents requested by her were granted. | ||
Thus, the DPA provided the controller with the possibility to reconsider the complainant’s request. Following which, the controller granted the complainant’s access request and sent her copies of the documents highlighted in the list first sent to her. | |||
After this, the DPA asked the complainant if she wanted to pursue the complaint, to which she replied that not all the documents she had requested and wished to receive were given to her. In this respect, the controller clarified to the DPA that it did provide all the documents in its possession but wanted to check again for further documents. After the review, it did not find any further documents. | |||
On 2 October 2023, the DPA informed the complainant of the controller’s reply, which the complainant did not comment. | On 2 October 2023, the DPA again informed the complainant of the controller’s reply, which the complainant did not comment. | ||
=== Holding === | === Holding === | ||
On the basis of the information provided, the Slovenian DPA concluded that the controller failed to take an appropriate decision on the complainant's access request to personal data at the time of the application, breaching [[Article 15 GDPR|Article 15 GDPR]] in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 ZVOP-2]. | On the basis of the information provided, the Slovenian DPA concluded that the controller failed to take an appropriate decision on the complainant's access request to personal data at the time of the application, breaching [[Article 15 GDPR|Article 15 GDPR]] in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 of the Slovenian Data Protection Act (ZVOP-2)], which provide that when a controller deals with a data subject request, it shall inform the individual of the decision and comply with the request within the time limit laid down in the GDPR. | ||
The DPA noted that the controller did not provide copies of the documents but only a list of the documents, | The DPA noted that the controller did not provide copies of the documents but only a list of the documents, which the controller justified by explaining that the requested documents were already in the possession of the complainant. Thus, the DPA stressed that the mere fact that an individual already possesses the personal data asked to the controller does not constitute a valid reason for refusing an access request. Therefore, at the time of the data subject's complaint, the controller failed to comply with [[Article 15 GDPR#3|Article 15(3) GDPR]], which provides that the data subject has the right to a copy of the personal data processed. | ||
Nonetheless, the DPA took into consideration the controller’s collaboration throughout the proceeding. Considering that the complainant also did not respond to the DPA's note of 2 October 2023, the DPA concluded that the controller had remedied the breach of the right of access by providing the complainant with all the documents it possessed containing the complainant's personal data, and decided that no specific measures were needed. | Nonetheless, the DPA took into consideration the controller’s collaboration throughout the proceeding. Considering that the complainant also did not respond to the DPA's note of 2 October 2023, the DPA concluded that the controller had remedied the breach of the right of access by providing the complainant with all the documents it possessed containing the complainant's personal data, and decided that no specific measures were needed. | ||
Latest revision as of 10:50, 24 January 2024
| IP - 07100-15-2023-1 | |
|---|---|
 | |
| Authority: | IP (Slovenia) |
| Jurisdiction: | Slovenia |
| Relevant Law: | Article 15 GDPR Article 12 ZVOP-2 Article 14 ZVOP-2 |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 29.11.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 07100-15-2023-1 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Slovenian |
| Original Source: | Informacijski pooblaščenec (in SL) |
| Initial Contributor: | ar |
The controller, a Slovenian Ministry, was found to have infringed Article 15 GDPR in conjunction with Articles 12 and 14 of the Slovenian Data Protection Act since, at the time of the data subject's complaint with the Slovenian DPA, it did not fully comply with the complainant’s access request.
English Summary
Facts
On 26 May 2023, the complainant, a public servant, submitted an access request to its former employer, a Slovenian Ministry, (the controller) to obtain copies of all the documents held on her. The controller partially complied with the request and provided the complainant with a list of all the documents it kept. However, it explained that it would not send copies of the documents since the complainant should already be in their possession.
Following the controller’s reply, on 3 July 2023, the complainant lodged a complaint with the Slovenian DPA because only part of the documents requested by her were granted.
Thus, the DPA provided the controller with the possibility to reconsider the complainant’s request. Following which, the controller granted the complainant’s access request and sent her copies of the documents highlighted in the list first sent to her.
After this, the DPA asked the complainant if she wanted to pursue the complaint, to which she replied that not all the documents she had requested and wished to receive were given to her. In this respect, the controller clarified to the DPA that it did provide all the documents in its possession but wanted to check again for further documents. After the review, it did not find any further documents.
On 2 October 2023, the DPA again informed the complainant of the controller’s reply, which the complainant did not comment.
Holding
On the basis of the information provided, the Slovenian DPA concluded that the controller failed to take an appropriate decision on the complainant's access request to personal data at the time of the application, breaching Article 15 GDPR in conjunction with Articles 12 and 14 of the Slovenian Data Protection Act (ZVOP-2), which provide that when a controller deals with a data subject request, it shall inform the individual of the decision and comply with the request within the time limit laid down in the GDPR.
The DPA noted that the controller did not provide copies of the documents but only a list of the documents, which the controller justified by explaining that the requested documents were already in the possession of the complainant. Thus, the DPA stressed that the mere fact that an individual already possesses the personal data asked to the controller does not constitute a valid reason for refusing an access request. Therefore, at the time of the data subject's complaint, the controller failed to comply with Article 15(3) GDPR, which provides that the data subject has the right to a copy of the personal data processed.
Nonetheless, the DPA took into consideration the controller’s collaboration throughout the proceeding. Considering that the complainant also did not respond to the DPA's note of 2 October 2023, the DPA concluded that the controller had remedied the breach of the right of access by providing the complainant with all the documents it possessed containing the complainant's personal data, and decided that no specific measures were needed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
