IP (Slovenia) - SI – 07101-5-2023-16
From GDPRhub
| IP - SI – 07101-5-2023-16 | |
|---|---|
 | |
| Authority: | IP (Slovenia) |
| Jurisdiction: | Slovenia |
| Relevant Law: | Article 15(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 24.02.2023 |
| Decided: | 13.11.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | SI – 07101-5-2023-16 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Slovenian |
| Original Source: | IP (in SL) |
| Initial Contributor: | n/a |
The Slovenian DPA held that a data subject was entitled to be informed of the purposes of a controller's processing log under Article 15(1)(a) GDPR. However, the DPA noted that whether the data subject is entitled to the entire processing log under an access request, must be decided on a case-by-case basis depending on the contents of the log and and applicable limitations (including derogations).
English Summary
Facts
On 17 January 2023, the data subject made an access request to Slovenia’s General Police Directorate (the controller) and requested a copy of the record of processing activities and the controller's processing log, under Article 15 GDPR.
As the controller is the Slovenian Police, the log file is a database of criminal offences committed by data subjects, photographs, fingerprints and DNA tests, but also includes information on processing operations that are not related to criminal law.
On 2 February 2023, the controller responded providing the data subject with their criminal record, offence record, photographic records, fingerprint data and DNA examination record. However, the controller refused to provide information relating to the record of processing activities and also refused to provide information concerning their processing logs.
On 24 February 2023, the data subject lodged a complaint with the Slovenian DPA concerning the controller’s refusal to provide information for their processing logs and record of processing activities. The complaint was limited to the controller's refusal to provide information regarding the purposes and the date/time of processing from the logs, and not the names of internal users.
Holding
The Slovenian DPA held that the controller was in violation of Article 15(1)(a) GDPR, as the purposes of processing of the logs fell within the scope of Article 15(1)(a) GDPR.
The Slovenian DPA considered that the information regarding the time of processing was necessary to understand the information about the purpose of the processing and to achieve the objectives of the right of access. They noted that the right to be informed about the processing of personal data does not explicitly include information about the duration of the processing, but nonetheless, it should be considered an essential part of the information about the processing of personal data.
In addition, the DPA following the EDPB’s Guidelines (2023, para 114), interpreted Article 15(1)(a) GDPR as not only imposing an obligation to provide information on the general purpose of processing of all personal data or of individual groups of data or data sets, but also specific information on a processing-by-processing basis for individual data.
Following from this interpretation of Article 15(1)(a) GDPR, the DPA held that generally the data and information contained in the processing logs are not automatically excluded from the scope of Article 15 GDPR. However, the granting of access to information contained in a controller's processing logs must be assessed on a case-by-case basis, taking into account any applicable exceptions and exclusions on the basis of compelling legitimate grounds (including, inter alia, those relating to the prevention and investigation of criminal offences).
In this case, the DPA held that there were no compelling legitimate interests overriding the data subject's right of access. As such, the data subject was entitled to be informed of the purposes and the date/time of processing from the logs. As a result, the DPA found a partial infringement of Article 15(1) GDPR. Consequently, the DPA ordered the controller to disclose the requested information.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
1 Number: 07101-5/2023/16 Date: 3.11.2023 The Information Commissioner, acting through the Supervisory Person (hereinafter referred to as the "SP"), pursuant to Article 77 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "General Data Protection Regulation") and Articles 30 to 34 of Regulation (EU) 2016/679 (hereinafter referred to as the "GDPR"). 163/22, hereinafter referred to as ZVOP-2), on the application of the applicant: ....., dated 21.2.2023, against the decision of the controller: MNZ, Policija, Štefanova ul. 2, 1501 Ljubljana, No. ....., dated 20.2.2023, in the matter of acquaintance with his own personal data, hereby issues the following decision in the matter of acquaintance with his own personal data DECISION: 1. it is hereby established that the controller MNZ, Policija, Štefanova ul. 2, 1501 Ljubljana, with regard to the request of 17.1.2023 from the applicant ....., has infringed Article 15(1) of the General Regulation and Article 24(2) of the General Data Protection Regulation, Article 15(1) of the General Data Protection Regulation and Article 24(2) of the General Data Protection Regulation. Article 5 of the GDPR, namely with regard to the information on the purposes and times (date and time) of the processing contained in the processing log (for the period from 5.5.2019 until the issuance of the decision), which the controller decided on in point 10 of the decision No ....., dated 20.2.2023; 2. the Operator is ordered to re-determine the applicant's request within 20 days at the latest, in accordance with Articles 18 to 25 of the GDPR, Articles 12 and 15 of the General Regulation and Articles 14 and 15 of the GDPR-2, by: making a full factual determination, i.e. a preliminary determination of the specific purposes, and assessing whether the individual processing (lines) and the data and information on the purposes give grounds for restricting the right to information under the GDPR, the PDPA and other laws; and to provide the notifier, in the light of the findings referred to in the previous indent, in so far as no grounds for restricting the right to information under the GDPR, the PDPA and other laws are provided, with an extract of the traceability log containing information on the dates of the processing (first column), the times of the processing (second column), the data (last column) and, in addition, information on the specific purposes of the individual processing, for all 366 rows, in accordance with the findings referred to in the previous indent; 3. it is concluded that, as regards the remaining part of the applicant's request and notification, the controller has not infringed Article 15 of the General Regulation and Article 24(2) of the GDPR; 4. the applicant is granted access to the administrative file No 07101-5/2023 with the IP, in respect of all documents except the processing log. However, following a final decision of the controller in a review procedure, the scope of the authorised inspection of the administrative file depends on the content of the decision. No specific costs were incurred by the IP. The applicant and the controller shall bear their own costs of the procedure. Reasoning: Relevant allegations - factual situation On 17.1.2023, the applicant, referring to the General Regulation, submitted a request for personal data to the controller, requesting a copy of the personal data and information on the processing of personal data under points (a) to (d) and (g) and (h) of the first paragraph of Article 15(1)(a) of Regulation (EC) No 1/2003. He explained that he would like to receive a copy of all personal data collected about him since 2015; he would also like to receive a copy of the accesses to his personal data, the purpose of the accesses, the dates of the accesses and the identification of the persons who carried out the accesses. On 20.2.2023, following the applicant's request, the controller issued Decision No ....., by which, on the basis of the General Regulation and the GDPR, it provided the applicant with all the information requested (points 1 to 9 and 11 of the operative part of the judgment) and provided him with a printout of the data in the criminal record, the offence record, the photographic record, the dactyloscopic record and the DNA examination record. Only in paragraph 10 of the operative part of the decision did the controller refuse the applicant's request for access to data on the internal processing of personal data (internal traceability data or data from the processing log). With regard to the refusal, the controller explained that the data requested are kept for the purpose of demonstrating the lawfulness of the processing and for the purposes of internal control, for the purpose of carrying out controls by the IP and other bodies, for the purpose of ensuring the integrity and security of the personal data, for the purpose of rectifying malfunctions of the IT system, and for the purpose of pre-trial and criminal proceedings (third paragraph of recital 22 of Article 22(1)(b) of the ECHR Decision of 12 December 2004 on the protection of personal data in criminal proceedings). The individual is not entitled to this data, as is clear from IP Opinions No 0712-1/2014/2773, No 0712-1/2014/3051 and No 0710-92/2018/4, etc. If the individual suspects unlawful processing of personal data, he/she may report the suspected breach to the IP or in the internal security procedure. On 24.2.2023, the whistleblower lodged a complaint with the IP against the rejection part of the decision. In the application, the notifier stated that it only insisted on the purpose and date of the processing in the processing log, but not on the personal names of internal users, for the period from 1 January 2021 onwards. The IP forwarded the notification to the controller for comments and requested clarification on the maintenance of the processing log. On 13.4.2023, the IP received a reply from the controller with detailed explanations on the maintenance of the processing log. On 15.5.2023, the IP sent the controller's explanations to the applicant for clarification and asked him to specify the claim. The applicant replied to the request on 17.5.2023 with a more specific and narrowed claim. On 22.5.2023, the CP requested the Controller to provide it with a complete extract of the traceability log for the period from 1.1.2021 to 20.2.2023 for the collections referred to in point 1 of the operative part of the Controller's decision. The requested extract was received by the HR on 1 June 2023. In accordance with Article 32(2) of the GDPR-2, on 10.10.2023 the IP forwarded the record of its findings to the notifier and the controller and invited them to comment on its preliminary findings. In its response, the notifier stated that it wished to continue the procedure. The operator explained that it had no objections and that it accepted the limitation of the inspection of the administrative file due to the possible restrictions under Article 25 of the ZVOPQD and Article 127 of the ZNPPol. The competence of the IP and the object and limits of the supervisory procedure Article 30(1) of the GDPR-2 provides that an individual who considers that the processing of his or her personal data by a controller infringes the provisions of the General Regulation, the GDPR-2 or other laws governing the protection of personal data (a whistleblower with a special situation) may lodge a request with the supervisory authority requesting supervision of the lawfulness of the processing of his or her personal data (a notification), and may also propose the necessary action to be taken in the event of the breaches identified, in order to achieve the restoration of the lawful state of affairs. A possible breach of the GDPR is also a breach of the right of access to one's personal data as defined in Article 15(1) of the GDPR. The IP, as supervisory authority, issues a decision after the supervision procedure in accordance with Article 34(1) of the GDPR-2. The appeal procedure is provided for in the GDPR for personal data falling under Article 1(1) of the GDPR. This provides that the ZVOPOKD "regulates the protection of the processing of personal data processed for the purposes of the exercise of these competences by the police, public prosecutors' offices, the Probation Administration of the Republic of Slovenia, the Penal Sanctions Enforcement Administration of the Republic of Slovenia and other state bodies of the Republic of Slovenia which are legally designated as competent in the fields of prevention, investigation, detection or prosecution of criminal offences or the enforcement of criminal sanctions". Article 27(1) of the GDPR provides that the supervisory authority, as the second instance authority, shall decide on an appeal by the data subject against a decision of a competent authority. In the present supervisory procedure, the IP determined whether and to what extent, i.e. with regard to which individual records, the conditions for consultation of the extract of the traceability log submitted by the controller on 1 June 2023 were fulfilled. As regards the remainder of the request, the controller has not infringed the right to be informed of personal data, since it has provided the applicant with all the information requested concerning the processing of the applicant's personal data. Moreover, the application does not relate to the remainder of the request or to points 1 to 9 and 11 and 12 of the controller's operative part of the decision. The IP also did not assess the entitlement to the personal names and SSNs of internal users in the context of the application against point 10 of the operative part of the decision, as the applicant had narrowed the request (i.e. his application no longer relates to internal users, but only to the purpose and dates of the processing), since under Article 15 of the GDPR and Article 24 of the GDPR, as well as the IP's previous practice, an individual is not in principle entitled to be informed of the identity of internal users, except in exceptional circumstances in accordance with the conditions set out in CJEU Judgment No C 579/21 ECJ. In the decision, the controller refers to the General Regulation and the GDPR as the substantive legal basis for the decision. The extraction of the traceability log would concern databases relating to criminal offences, misdemeanours, photographed persons, dactyloscopic persons and DNA tests, where the controller explains that the extraction does not only relate to processing relating to criminal offences but also to processing which does not fall within the scope of the GDPR. Therefore, the IP also decided on the whistleblower's notification on both legal bases and in a single "supervisory procedure based on a notification of a whistleblower with a special situation" under Articles 30 to 34 of the GDPR-2. This supervisory procedure consumes or also includes the appeal procedure under Article 27 of the ZVOPOKD: because the supervisory procedure gives even more procedural rights to the participants in the proceedings, because the provisions of the ZUP are also applicable in this supervisory procedure, because the uniform treatment is in line with the principle of economy and the principle of protection of the rights of the parties, without undermining the right to appeal, because, last but not least, the ZVOPOKD also provides for a supervisory procedure based on the notification of a whistle-blower with a special status in Article 33. The processing log extract in question for the period from 5.5.2019 has 366 lines with the following headings: date and time, terminal address/ip, application/node, group, user ID, user's surname, user's first name, 1 function, 1 area, 1 case/document, 2 functions, 2 areas, 2 case/documents, cr of person, person's surname, person's first name, user's parameters, data. 3. Findings in the control process 1. Pursuant to Article 15(1)(a) of the GDPR, the controller is obliged to provide the data subject with information on the purposes for which his/her personal data are processed. This does not only mean generalised information on the general purpose of the processing of all personal data or of individual groups of data or data sets, but also specific information on a processing-by-processing basis for individual data (for information purposes only, e.g. 'for the resolution of case No (...)', 'for the provision of data to the user (...)', 'for the rectification of data due to an error', 'for use in an internal complaint procedure', 'for the implementation of internal controls', 'for the verification of the alleged facts/compliance with the terms and conditions'). It does not matter where and in how many places and in what form this information is held by the controller, nor does it matter whether it is to be accessed on the basis of an internal 'analysis' and 'synthesis' of existing data, i.e. some broader enquiry (e.g. the 'analysis' and 'synthesis' of existing data, i.e. some broader enquiry (e.g. the 'analysis' and 'synthesis' of existing data). The General Regulation requires the controller to provide purpose information, but does not deal with how the controller should provide it and how much effort it should make to do so. In order to demonstrate the lawfulness of the processing of personal data, the controller must itself know the purposes for which it has processed the individual data in the specific individual processing and provide this information to the data subject. This means that he or she must find this information for himself or herself or create it by means of objectively feasible enquiries on the basis of available sources of information, provided that the processing log is such that it does not itself disclose the specific purposes. The IP notes that the extract in question does not contain the specific purposes for which personal data are processed, but that the purposes of use can be partially and indirectly inferred, in particular from the headings 'data', 'case/document' and 'field', but not without a proper interpretation by the controller. It is clear from the controller's explanations that information on the specific purposes should be obtained orally from the employees on the basis of the selected processing operations. This means that the requested information on specific purposes does not yet exist in a documented form or that the condition of a materialised form is not yet met. However, this does not mean that the purposes are not known, do not exist or cannot be obtained; only in this case could the controller refuse to provide information on the specific purposes. In order to comply with the request of the data subject, the controller is obliged to generate information on the specific purposes of the processing by means of internal enquiries, as these do not necessarily have to be set out in the processing log. It is possible to identify the specific purposes (which may be stated or derived from other documents). 2. Paragraph 114 of the European Data Protection Board Guidelines (2023) implies that information on purposes must be specific. It is not sufficient to list general purposes without clearly explaining which purposes are relevant in a specific case. If processing is carried out for several purposes, the controller must clearly explain which data are processed for which purpose. It follows from recital 83 of the judgment of the Court of Justice of the EU in Case C 579/21 (2023) that information relating to acts of access to the personal data of a data subject, concerning the dates and purposes of those acts, constitutes information which that data subject has a right to obtain from the controller pursuant to the first paragraph of Article 15(1)(b) of Directive 95/46/EC. The CJEU also stated in the aforementioned judgment that, in relation to the controller's log files, the provision of a copy of the information contained in those files may prove necessary in order to comply with the obligation to provide the data subject with access to all the information referred to in Article 15(1) of the General Regulation. The Court also stated that the processing logs disclose the existence of processing, which is information to which the data subject must have access under Article 15. Article 15 of the General Regulation; moreover, they show the frequency and intensity of the acts of consultation, which thus enable the data subject to ascertain whether the processing carried out is in fact justified by the purposes stated by the controller. The IP takes the view that the processing time is necessary to understand the information on the purpose of the processing and to achieve the purposes of the right to information. The right to information on the processing of personal data does not explicitly include information on the time of processing, but it should be considered as an essential element of information on the processing of personal data, depending on the circumstances of the individual case and if the applicant requests this information. The ED notes that the identification (specification) of the processing of personal data according to the time of processing is inextricably linked to the provision of other information on the processing of personal data to which the individual would be entitled in a specific case. It follows from recital 63 of the General Regulation that if the individual could not obtain information on the date of processing, he would not be able to exercise his right to information on processing for the purpose of knowing about the processing and verifying its lawfulness; every individual should have the right to be informed of the purposes of the processing of personal data, preferably the period for which the personal data are processed. The other fields of the specific processing log do not fall under any of the information referred to in points (a) to (h) of Article 15(1) of the GDPR or Article 24(2) of the GDPR and are not the applicant's personal data. It is data about data (data relating to the applicant's otherwise personal data) and not data directly relating to the applicant as a person. Therefore, the notifier is not entitled to these parts of the processing log and the controller has not been in breach with regard to them. An exception may be made for headings (for example, 'case/document' and 'field') which, by virtue of their content, may supplement the information on the purposes of the processing, but these headings or information will have to be identified by the controller itself as possibly forming part of the information on purposes and, consequently, disclosed to the notifier. 5. The ED agrees with the controller's view that the individual is not, as a general rule, entitled to the entire processing log (depending on its specific content, as there is a significant difference between controllers in this respect) and that the purpose of keeping a processing log is mainly to allow internal and external control of the lawfulness of the processing and to correct errors in the information system, and that the individual cannot exercise such control over the lawfulness of the processing of personal data. This position is indeed in line with the IP Opinions listed by the controller (Nos 0712-1/2014/2773, 0712-1/2014/3051 and 0710-92/2018/4), but these opinions do not explicitly provide that the data subject is not entitled to information on the purposes and the dates or times of the processing that may be contained in the processing log, but refer to the processing log in general and focus on the non-disclosure of the identity of the employees. In addition, in the specific case, more recent case law, in particular based on the above-mentioned CJEU judgment, should be taken into account. The above position does not imply that all the data contained in the processing logs, nor the information contained therein, will be available to the individual in every case and at all times. It only means that the data and information contained in the processing logs are not automatically excluded from the scope of Article 15 of the GDPR, but are nevertheless subject to the assessment of exceptions and exclusions on the basis of compelling legitimate grounds (including, inter alia, on the grounds of the prevention and investigation of criminal offences and any other legitimate grounds). 6. The same reasoning as set out in the preceding paragraphs, with reference to Article 15 of the GDPR, applies to information on the time of processing and the purposes of processing under Article 24 of the GDPR, since the substantive legal regulation of this right is the same as under the GDPR. Under Article 24(2) of the GDPR, in addition to the right to a copy of the data themselves (their content), the data subject has the right to obtain specific information on the purposes of the processing and their legal basis. 7. The IP did not necessarily need the specific information on the purposes of the individual processing contained in the processing log in question in order to take a decision on the notification: because the IP cannot even formulate them concretely in the final decision on behalf of the controller; this can only be done by the controller itself, as the specific wording of the purposes is not specified in the GDPR or in the GDPRCPR (both provisions only refer to 'purposes'); it is a 'free' or 'open' category of information; because the IP is also not allowed to mention them in the final decision, in order to be able to invoke the legal protection of the controller; because in the present case, it is not a question of fact as to whether the purposes already communicated are genuine, existent and relevant in substance, but a question of law as to whether the notifier is entitled to them; because the controller must in any event obtain the specific purposes of the individual processing, unless he finds that he does not have them (even in this case, he must inform the notifier that he has no information about the purposes or that they are unknown to him). Therefore, the IP did not ask the controller to communicate to it the specific purposes of the processing, but, by the final decision, ordered the controller to search for, identify and formulate (formulate or word) the purposes of the processing and to communicate this information to the notifier. The notifier has the possibility to lodge a separate complaint against this decision of the controller. 4. Conclusion In the light of the foregoing considerations, the decision of the Hearing Officer is as set out in paragraphs 1, 2 and 3 of the operative part of this Decision, namely: the IP found a partial infringement of Article 15 of the General Regulation and Article 24 of the GDPR as a result of the partial refusal of the request for information and, in this respect, ordered the controller to provide the notifier, after a prior ascertainment procedure, with the information from the processing log to which it is entitled, , the IP found that, as regards the remainder of the request and the notification, the controller had not infringed the data protection rules with regard to the right to know one's own personal data. Article 34(3)(1) of the GDPR-2 provides that the decision in the supervision procedure under the provisions of this Section shall, in addition to the elements laid down by the law governing the general administrative procedure, also contain the permissible scope of the examination of the file of the case for a whistleblower with a special situation. This is to be decided irrespective of the individual's request and in the event that the individual may request the IP to inspect the supervisory or administrative file on the basis of Article 82 of the C.P.A. In this respect, the IP decided in point 4 of the operative part of the present decision to allow the applicant to inspect the file of the supervisory case No 07101-5/2023, as there are no specific obstacles to the inspection, with the exception of the processing log in question, which will be accessible to the applicant in the light of the controller's final decision. Pursuant to Article 118(1) of the CPA, the Authority shall decide on the costs of the proceedings in its decision. The Authority has not incurred any specific costs in the present supervisory procedure; the notifier and the controller shall bear their own costs (point 5 of the operative part of the decision). This decision is exempt from the payment of administrative charges in accordance with the provisions of the Administrative Charges Act (ACA). Lessons on the remedy: This decision may not be appealed but may be the subject of an administrative dispute. An administrative dispute may be brought by lodging an action with the Administrative Court, Fajfarjeva 33, 1000 Ljubljana. The action must be brought within thirty days of notification of this Decision, either in writing directly before the said court or by registered post or orally on record. If the application is sent by registered post, it shall be deemed to have been received in time if it is deposited at the post office on the last day of the period for lodging the application. In addition to the original, a copy or a copy of this Decision, the application shall be accompanied by a copy or copies of the application and the annexes for the defendant and, if anyone is affected by the Decision, for him. The application shall be accompanied by a court fee. Dr. Urban Brulc, Univ. Dipl, State Data Protection Supervisor
