IP - N/A

IP - N/A
Authority:	IP (Slovenia)
Jurisdiction:	Slovenia
Relevant Law:	Article 13 GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	15.03.2021
Published:	16.03.2021
Fine:	None
Parties:	n/a
National Case Number/Name:	N/A
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Slovenian
Original Source:	IP (in SL)
Initial Contributor:	GDPR plus

The Slovenian DPA decided that personal data collected when registering an interest in vaccination through the e-government portal may only be processed after the individual has received clear, accurate and reliable information about who is collecting it and for what purpose.

English Summary

Facts

In the Republic of Slovenia, in addition to applying for vaccination with a personal physician, a comprehensive data collection on vaccination interest is conducted in parallel via the eGovernment portal, which is not an application for vaccination. Individuals receive completely vague and meager information when applying for the vaccination expression of interest via the eGovernment portal, and additional ambiguity is introduced by various diametrically opposed interpretations of individual speakers at press conferences of the Government of the Republic of Slovenia regarding the significance of this role.

Holding

On 15 March 2021, with the aim of protecting the rights of individuals, the IP issued a provisional decision to taxpayers - the Ministry of Public Administration (MPA), the Ministry of Health and the National Institute of Public Health (NIJZ) - imposing an obligation to provide clear, accurate and reliable information in accordance with Article 13 of the General Regulation (GDPR) - including who manages all personal data, what their purposes are and the legal basis for their processing - and restricting further processing of the personal data collected.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.

Personal data collected when expressing interest in vaccination through the eGovernment portal may only be processed once data subjects have received clear, accurate and reliable information about who collects such data and for what purpose.

In the Republic of Slovenia, in addition to the application for vaccination with personal doctors, a comprehensive data collection on interest in vaccination is carried out in parallel via the eGovernment portal, which does not imply an application for vaccination. Individuals receive completely vague and meager information when applying for the expression of interest in vaccination through the eGovernment portal, and additional ambiguity is introduced by various diametrically opposed interpretations of individual speakers at press conferences of the Government of the Republic of Slovenia regarding the importance of this role. Therefore, on 15 March 2021, with the aim of protecting the rights of individuals, the IP issued a provisional decision to taxpayers - the Ministry of Public Administration (MPA), the Ministry of Health and the National Institute of Public Health (NIJZ) - imposing an obligation to provide clear, accurate and reliable information in accordance with Article 13 of the General Regulation (GDPR) - including who manages all personal data, what their purposes are and the legal basis for their processing - and restricting further processing of the personal data collected.

In December 2020, the IP initiated an inspection procedure on the implementation of the provisions of ZVOP-1 and the GDPR following a notification of suspected excessive processing of personal data of applicants for interest in vaccination against COVID -19 via the e-Administration portal and suspected inadequate notification of individuals. Proceedings were initially initiated against the MPA and, based on a referral by the MPA, against the NIJZ and the Ministry of Health.

The justification for notifying individuals of inadequate information about the processing of their personal data was there from the outset, as none of the three taxpayers wanted to take on the role of data controller and the associated responsibility for processing personal data. Despite no less than six IP requests for explanation, the taxpayers have not been able to clearly and reliably explain the purpose of the application on the eGovernment portal, nor have they explained the legal basis for this extensive processing of personal data to date.

In the proceedings, the IP received contradictory statements from the taxpayers and through the statements of the representatives of the authorities in the media, which did not correspond to the actual situation established in the examination proceedings. For example, the NIJZ initially denied that there was any cooperation in developing and setting up the online form, even though individuals received a notice of receipt of the application signed with the NIJZ. Even as the online form was being unveiled, the Minister of Public Administration pointed out at a press conference on December 8, 2020, that decisions about the use of the data collected would be made after the fact, which is in complete conflict with data protection law, and that it does not mean an order to vaccinate.

The IP has repeatedly stated in public that an individual can (also) be put in the order of inoculation through a particular application on the e-government portal, but this purpose was never explicitly and clearly communicated to the individual in the sparse information given when his data was collected. reported. This is also not clear from any version of the National Vaccination Strategies against Covid-19 (December 2020 and March 2021). Therefore, the collection of personal data through the e-governance portal has resulted in misleading the individual as it is not objectively comprehensible what he has actually achieved by submitting the application. 

The review process has also revealed that no one has yet accessed the personal data collected through the eGovernment portal and that the application for vaccinations is only made through the personal physician. This, of course, calls into question the need for such a massive collection of data from more than 140,000 individuals.


A concrete example shows the importance of predictable, fair and transparent processing of personal data, especially by state authorities, and the consequences for individuals of the lack of thoughtful preparation of the content of requests for data collection. It is certainly in the interest of all citizens that vaccination information is comprehensive, clear and accurate, and that they know when and under what conditions it is their turn.

Therefore, on the basis of the findings of the investigation, the IP issued a provisional decision to all three taxpayers, on the basis of which they have to comply with the obligation to inform individuals about the processing of their personal data (who actually processes their data, for what purposes, how long these data are stored, etc.), which is the basis of a transparent and lawful processing of personal data. The provisional decision was adopted on the basis of the information available at the time of its adoption, the final decision will follow. Undoubtedly, when adopting the final decision, the IP will also take into account the fact that this collection is no longer up to date, as many individuals who have submitted applications have most likely already been vaccinated due to the classification in priority groups and registration with a personal doctor.