IP (Slovenia) - SI – 07101-5-2023-16
| IP - SI – 07101-5-2023-16 | |
|---|---|
 | |
| Authority: | IP (Slovenia) |
| Jurisdiction: | Slovenia |
| Relevant Law: | Article 15(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 24.02.2023 |
| Decided: | 13.11.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | SI – 07101-5-2023-16 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Slovenian |
| Original Source: | IP (in SL) |
| Initial Contributor: | n/a |
The Slovenian DPA held that while generally, a data subject is not entitled to the entirety of a controller’s processing log, they are entitled to be informed of its purposes of processing under Article 15(1)(a) GDPR.
English Summary
Facts
On 17 January 2023, the data subject made an access request to Slovenia’s General Police Directorate (the controller), requesting a copy of their personal data under Articles 15(1)(a)-(d) GDPR and Articles 15(1)(g)-(h) GDPR.
On 2 February 2023, the controller responded providing the data subject with their criminal record, offence record, photographic records, fingerprint data and DNA examination record. However, the controller refused to provide information concerning to their processing logs, which the data subject requested as part of their request.
On 24 February 2023, the data subject lodged a complaint with the Slovenian DPA concerning the controller’s refusal to provide information for their processing logs. The data subject submitted that they had only requested the purposes and the date/time of processing from the logs, and not the names of internal users.
Holding
The Slovenian DPA held that the controller was in violation of Article 15(1)(a) GDPR, as the purposes of processing of the logs fell within the scope of Article 15(1)(a) GDPR.
The DPA following the EDPB’s Guidelines (2023, para 14), interpreted Article 15(1)(a) GDPR as not only imposing an obligation to provide information on the general purpose of processing of all personal data or of individual groups of data or data sets, but also specific information on a processing-by-processing basis for individual data. The DPA further explained that it does not matter where and in how many places and in what form this information is held by the controller.
Following from this interpretation of Article 15(1)(a) GDPR, the DPA held that while generally the data subject is not entitled to the entire processing log under an access request, they are entitled to be informed of the purposes of processing for the log and the date and time of processing.
As a result, the DPA found a partial infringement of Article 15(1) GDPR as the controller failed to disclose information relating to the purposes of the processing log and the date and time of processing in the log requested by data subject. Consequently, the DPA ordered the controller to disclose the requested information.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
