IP (Slovenia) - 0603-46/2023/13

IP - 0603-46/2023/13
Authority:	IP (Slovenia)
Jurisdiction:	Slovenia
Relevant Law:	Article 13 GDPR Article 100(1)(2) ZVOP-1 Article 100(3) ZVOP-1 Article 76(3) ZVOP-1
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	26.10.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	0603-46/2023/13
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Slovenian
Original Source:	Informacijski Pooblaščenec (IP) (in SL)
Initial Contributor:	Sara Horvat

The Slovenian DPA found that a controller failed to display its video surveillance notice on its premises in a way that adequately notified data subjects of the video surveillance. As a result, the controller had failed to meet its informational obligations under domestic law.

English Summary

Facts

The Slovenian DPA carried out an investigation in the premises of a controller, following a complaint regarding their use of video surveillance and the lack of adequate notice for its use.

The controller had their premises under video surveillance. The video surveillance presented an information notice. However, this notice was not placed in a way that would allow for an individual to be informed about the surveillance before entering the premises and to decide whether they wanted to be in the area covered by the video surveillance.

Holding

The Slovenian DPA held that the controller had failed to comply with its duty to ensure that data subjects were notified of the controller's use of video surveillance. As such, the controller had violated Article 76(3) ZVOP-2.

The controller had displayed an information notice for their use of video surveillance. However, this notice was not placed in a way that would allow for an individual to be informed about the surveillance before entering the premises and to decide whether they wanted to be in the area covered by the video surveillance.

The DPA found the placement of the notice to breach of Article 76(3) ZVOP-2. As a result, the DPA held the controller liable on the basis of Article 100(3) ZVOP-2 in conjunction with Article 100(1)(2) ZVOP-2, and issued a reprimand.

Comment

ZVOP-2 is Slovenia's national implementation of the GDPR.

Article 76(3) ZVOP-2 states that a controller must ensure that a video surveillance notice includes the information required by Article 13 GDPR. It further requires a written or unambiguous graphic description of the fact that video surveillance is being carried out, the purposes of the processing, the name of the controller of the video surveillance system, a telephone number or an e-mail address or a website address to exercise the data subject's rights in the field of the protection of personal data, information on the specific impact of the processing, in particular further processing, the contact details of the authorized person (telephone number or e-mail address) and information about unusual further processing, such as transfers to third country entities, live monitoring and the possibility of audio intervention in case of live monitoring.

English Machine Translation of the Decision

The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.

Number: 0603-46/2023/13
Date: 26 October 2023

The Information Commissioner (hereinafter: the misdemeanor authority) issues through an authorized official..., the State Supervisor for the Protection of Personal Data, ex officio on the basis of the second paragraph of Article 51 and Article 46 of the Act on Misdemeanors (Official Gazette of the Republic of Slovenia, No. 29/11 - official consolidated text, 21/13, 111/13, 74/14 - US Sec, 92/14 - US Sec, 32/16, 15/17 - US Sec, 73/19 - US Sec, 175 /20 – ZIUOPDVE and 5/21 – odl. US; hereinafter: ZP-1), and Articles 2 and 8 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, no. 113/05 and 51/07 – ZUstS-A ; hereinafter: ZInfP), in proceedings on a misdemeanor against a legal entity... (registered number: ...) and its responsible person..., due to a misdemeanor under the first paragraph of Article 100 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163) /22, hereinafter: ZVOP-2), next



DECISION ON OFFENSE



Violator:

1. responsible person: ...

is responsible

for a misdemeanor

according to the third paragraph of Article 100 of ZVOP-2 in relation to point 2 of the first paragraph of Article 100 of ZVOP-2,

which he did by failing to ensure that, as a responsible person of a legal entity..., during the implementation of video surveillance in... on the premises..., on... to become familiar with the implementation of video surveillance and that entry into the controlled area may be refused because the video surveillance notification on the day of the visit on ... was not placed in place before entering the area, i.e. the main entrance to the facility, where video surveillance was carried out, as the notice was only found ... when video surveillance was already being carried out on individuals entering the facility, and video surveillance was also carried out with a camera marked as ..., which violated the provision of the third paragraph of Article 76 of ZVOP-2.

... committed the offense described above in the performance of activities and in the name and with the means of a legal entity ... in which he was authorized to perform work and tasks ... and as a director was obliged to ensure the implementation of video surveillance in accordance with the provisions of ZVOP-2, as a result of which on the basis of the first paragraph of Article 15 of the ZP-1 and the first paragraph of Article 15.a of the ZP-1, he is responsible for the said offense as a responsible person of a legal entity...

2. responsible legal entity: ...

is responsible

for a misdemeanor

according to point 2 of the first paragraph of Article 100 of ZVOP-2,

which he did... by not ensuring that the published video surveillance notice was visibly and distinctly published in a way that would allow an individual , to become familiar with the implementation of video surveillance and that entry into the controlled area may be refused because the notification about video surveillance on the day of the visit on ... was not placed in the place before entering the area, i.e. ... video surveillance was also carried out with a camera marked as ..., which violated the provision of the third paragraph of Article 76 of ZVOP-2.

... committed the described offense in the performance of activities and in the name and with the means of a legal entity ... for which he was authorized to perform work and tasks ... and as director was obliged to ensure the implementation of video surveillance in accordance with the provisions of ZVOP-2, as a result of which the legal entity ..., in accordance with the first paragraph of Article 14 of ZP-1, is liable as a responsible legal entity for the listed offences.

Therefore, on the basis of the third paragraph of Article 100 in relation to point 2 of the first paragraph of Article 100 of the ZVOP-2, responsible legal persons on the basis of the 2nd point of the first paragraph of Article 100 of the ZVOP-2 and when applying the first and the second paragraph of Article 26 and the first paragraph of Article 21 of ZP-1


and with words


1. to the responsible person of the legal entity...: REMINDER;

2. to legal entities...: REMINDER.


Based on the first paragraph of Article 143, in relation to the first paragraph of Article 144 and the second paragraph of Article 58 of the ZP-1, the violator responsible person must pay a court fee in the amount of EUR 30.00. The court fee, which is assessed to the violator for the reprimand in accordance with tariff number 8112 of the Court Fees Act (Official Gazette of the Republic of Slovenia, No. 37/08, with sp., hereinafter: ZST-1) in the amount of 30.00 euros, must be paid by the violator as responsible person to pay to the recipient's account: ...

The infringing responsible legal entity ... must pay a court fee in the amount of 30.00 euros based on the first paragraph of Article 143 in relation to the first paragraph of Article 144 and the second paragraph of Article 58 of the ZP-1. The court fee, which is assessed to the violator for the issued warning under tariff number 8112 ZST-1 in the amount of 30.00 euros, must be paid by the violator as a responsible legal entity to the recipient's account: ...

Violators must pay the court fee within fifteen (15) days after the decision on the offense becomes final. After the deadline for payment has passed, offenders can apply to the authority responsible for forced recovery (Financial Administration of the Republic of Slovenia) to pay the fine and the costs of the procedure (court fees) in installments.

If the legal entity and the responsible party do not pay the costs of the procedure (court fees) within the specified period, the costs of the procedure (court fees) will be forcibly recovered.

LEGAL LESSON: A request for judicial protection is allowed against a decision on a misdemeanor. The request must be announced in writing within eight (8) days of receipt of this decision to the Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, otherwise it is considered that the beneficiary of the request (infringer, legal representative or defender) has waived the right to request judicial protection. The notice of request is sent by post or delivered directly in two copies and is considered timely if submitted on the last day of the deadline for submitting the notice of request by registered mail or directly to the authority that issued the decision. The announced filing of a request for judicial protection may be withdrawn until the deadline for filing the announcement of this request expires.

If the beneficiary of the request for judicial protection does not announce or withdraws the announcement within the legal deadline for filing this request, it is considered that he has waived the right to request for judicial protection.

If none of the beneficiaries of the request for judicial protection announces this request, the misdemeanor authority does not make a decision on the offense with reasons, but it is considered that a final decision has been served on the date of service of the decision without reasons, which with the expiration of the deadline for announcing the request for judicial protection becomes final.

When at least one of the beneficiaries of the request for judicial protection announces the filing of this request, a written decision on the offense with reasons is drawn up and sent no later than 30 days after the announcement of the filing of the request for judicial protection is received. In this case, the decision with reasons is served on all beneficiaries of the request for judicial protection.

Under the conditions and in accordance with the regulations governing the financial operations of the offense authority, the violator can also pay the costs of the procedure with a non-cash means of payment.