IP (Slovenia) - IP - 07141-10-2023
From GDPRhub
| IP - IP - 07141-10-2023 | |
|---|---|
 | |
| Authority: | IP (Slovenia) |
| Jurisdiction: | Slovenia |
| Relevant Law: | Article 17(1) GDPR Article 17(2) GDPR 34 and 55 Article ZVOP-2 |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 06.04.2023 |
| Decided: | 20.07.2023 |
| Published: | 20.07.2023 |
| Fine: | n/a |
| Parties: | National Police Natural person |
| National Case Number/Name: | IP - 07141-10-2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Slovenian |
| Original Source: | Odločba 07141-10/2023/13 z dne 20.7.2023 (in SL) |
| Initial Contributor: | Spela |
Following a request for erasure, the controller failed to take reasonable steps to inform online media outlets to erase the applicant's personal data. The Slovenian DPA found a violation of the right to be forgotten under Article 17(2) GDPR.
English Summary
Facts
On 3 April 2023, the applicant requested the local Police Station (the controller) to delete from its website the information concerning her disappearance, as well as from the websites of the media outlets that had picked up the news from the police website.
In a reply dated 6 April 2023, the controller explained that her requests could not be granted because they were not responsible for the content and its deletion from the other online portals.
Thus, the applicant filed a complaint to the Slovenian DPA against the controller, and the DPA then began its proceedings by conducting two calls with the controller.
The controller confirmed to the DPA that it had removed the applicant's data from its website since its publication was no longer necessary for the purpose of the search for this person. It further explained to have ensured compliance, after the proceedings started, by also communicating to all media outlets that still had news of the applicant's disappearance published online that the applicant had requested the deletion of her personal data. In the notification, the controller had explained to the media outlets that this was a submission of an erasure request, which they had to comply with in accordance with the GDPR.
Holding
The Slovenian DPA held that the controller violated Article 17(2) GDPR, which regulates the right to be forgotten. In accordance with this provision, upon receiving a deletion request, the controller should have taken reasonable steps to inform the controllers to whom the applicant's personal data had been forwarded that the applicant requested the deletion of her personal data.
In the present case, it was clear that the applicant wished to have her information removed as soon as possible from the internet. Thus, the controller should have complied with Article 17(2) GDPR by sending a notification to every media outlet that published the missing person's details stating that the applicant had requested erasure of the information.
Hence, the DPA found that at the time of the submission of the notification on 6 April 2023, the controller was in breach of Article 17(2) GDPR. However, in the course of the proceedings before the DPA, the controller demonstrated its commitment to ensuring compliance with the GDPR, followed the findings of the DPA and remedied the infringement of Article 17(2) GDPR. Therefore, the DPA decided not to impose additional measures on the controller.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
Number: 07141-10/2023/13 Date: 20/07/2023 The Information Commissioner (hereinafter: IP) issues according to the State Supervisor for the Protection of Personal Data..., on the basis of Articles 2 and 8 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, no. 113/05 and 51/07 – ZustS-A, in hereinafter: ZInfP), Articles 57, 58 and 77 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals in the processing of personal data and on the free flow of such data and on the repeal of Directive 95/ 46/EC (General Data Protection Regulation, hereinafter: General Regulation) and Articles 34 and 55 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22; hereinafter: ZVOP-2), in the process, which IP, as a supervisory authority, conducted on the basis of the application of the applicant with a special position... (hereinafter: the applicant) dated 6 April 2023 against the Ministry of the Interior, Police, Štefanova ulica 2, 1501 Ljubljana (hereinafter: the supervised operator) the next one DECISION: 1. Supervised operator, i.e. The police, at the time of filing the report on 6 April 2023, violated Article 17(2) of the General Data Protection Regulation by failing to take reasonable measures after receiving the deletion request to inform the online media that the applicant was requesting , to delete her personal information from any posts about her disappearance. 2. During the procedure before the IP, the supervised manager eliminated the violation, so measures to eliminate the consequences of the violation are not ordered. 3. The applicant shall not be restricted in reviewing the file of the case, which is kept under no. 07141-10/2023. 4. IP special costs were not incurred in this procedure, the applicant and the controlled operator bear their own costs of the procedure. JUSTIFICATION 1 Actual situation 1. On April 3, 2023, the applicant requested the deletion of her personal data from the online media (about the individual as a missing person), which she filed with the Ljubljana-Bežigrad Police Station. In a reply dated 6 April 2023, the supervised administrator explained that he could not comply with her request because he was not responsible for the content and deletion of content from online portals. 2. The applicant complained to the IP against the manager's response and claimed that the Police, who published her photo with her husband's permission, should also take care of removing the posts from the websites. 3. In connection with the subject of this control procedure, the IP conducted two telephone interviews with the authorized person for the protection of personal data at the controlled operator (official note No. 07141-10/2023/8). 4. With letter no. 07141-10/2023/9 dated June 6, 2023, the IP informed the supervised operator of the findings so far. After re-examining all the circumstances of the case, the IP again sent the findings on the case to the supervised manager with letter no. 07141-10/2023/10, in which he asked him to ensure compliance with Article 17(2) of the General Regulation. 5. With the findings in letter no. 07141-10/2023/10, the applicant agreed. The supervised operator notified the IP about the measures taken with letter no. 071-7058/2022/6 (285-19) dated 19/07/2023. The controlled operator ensured compliance by once again informing all media via the address that the applicant requested the deletion of her personal data from the websites by those media , who still have news about her missing posted online. In this notification, the controlled administrator also explained that since the publication of her personal data was no longer necessary for the purpose of searching for this person, the Police removed her data from their website. To the notification, the supervised administrator also attached the applicant's request, stating her personal data, which are necessary to decide on the request for deletion (name, surname, address, web address). In the notice, the supervised manager of the media additionally explained that the receipt of this notice is considered as filing a request for deletion with the media that has published news about the missing person and that it is the media's obligation as the manager of the applicant's personal data to decide on this request for deletion in accordance with ZVOP-2 and the General Regulation by notifying the applicant of the measures taken and the reasons for this no later than one month after receiving the deletion request. 2 Findings of the IP 6. The application is justified. 7. Article 17(2) of the General Regulation stipulates that when the controller publishes personal data and is obliged to delete personal data in accordance with paragraph 1, taking into account the available technology and implementation costs, it takes reasonable measures, including technical ones, that controllers that process personal data data, informs that the data subject requests them to delete any links to this personal data or copies thereof. 8. In accordance with the law, the controlled administrator published and removed the personal data of the applicant as a missing person on his website. He also informed other operators (online media according to the address) about the fact that the missing person had been found. In doing so, he did not fulfill his obligation from Article 17(2) of the General Regulation, which regulates the right to be forgotten. In accordance with this provision, upon receiving a request for deletion, the controlled controller should take reasonable steps to inform the controllers to whom the applicant's personal data has been forwarded that the applicant requests from them the deletion of her personal data. 9. The right to be forgotten, which is also widely represented in EU jurisprudence, is intended especially for greater control of individuals over their personal data, which is processed on a large scale in the conditions of modern (Internet) society. The purpose of the provision from 17(2) of the General Regulation is to limit the dissemination of published personal data already by submitting a request to the source, if the conditions for deletion are met. This is with the aim of making it easier and more effective for individuals to protect their privacy. 10. Information about the fact that a certain person was missing and the circumstances related to his disappearance can significantly affect his public image and interfere with his dignity in the future. Therefore, it is understandable that a person who was missing but is no longer there can legitimately expect privacy regarding the fact of his disappearance (regardless of the fact that at a certain moment this was relevant information). The purpose of the Police notification about missing persons is clearly aimed at launching a search as quickly and as widely as possible. When a person is found, the fact that they were once missing is no longer relevant. Therefore, the Police deletes the data from its website. Nevertheless, news about missing persons can remain on online portals for a decade after the persons are found; also regardless of whether they are missing children, what details regarding the disappearance were relevant at the given moment, etc. It should also be added that the Police notice on missing persons does not have the nature of a public notice with the aim of ensuring the transparent operation of the Police in the sense of the ZDIJZ (which the media have a legitimate interest in reporting, because they thereby realize the public interest in accordance with the ZMed). In order to secure their rights in relation to the media, individuals must turn to the court - in accordance with the third paragraph of Article 73 ZVOP-2, rights in the field of personal data protection (including the right to be forgotten) are asserted before the courts; IP is not competent in this part. 11. In the case under consideration, it is clear that the applicant wants to achieve the removal of as much information as possible from the Internet about the fact that she was once treated by the Police as a missing person. Article 17(2) of the General Regulation also gives the individual the right to request the controller, who has published the data and then deleted it in accordance with Article 17(1) of the General Regulation, to inform the controllers to whom the personal data has been forwarded that the individual requests deletion also from these third-party controllers and forwards this request to them. In the circumstances of the case at hand, this would mean that all media outlets that published the missing person should have received notification from the Police that the missing and found person is requesting deletion, and should have decided on that deletion request in accordance with their obligations under Article 17 General regulations. As already mentioned, judicial protection is prescribed as a legal remedy against the decision of an online media. 12. In order to ensure compliance with Article 17(2), the controlled operator took action in accordance with the request of IP no. 07141-10/2023/10 as it follows from paragraph 5 of the explanation of this decision. The IP notes that the controlled controller has thereby fully fulfilled its obligations under Article 17(2) of the General Regulation in relation to the individual's request to delete her personal data. 13. At the time of the filing of the application dated 6 April 2023, the controlled operator otherwise violated Article 17(2) of the General Regulation, as the IP found in point 1 of the ruling. During the pre-IP process, however, the supervised operator demonstrated a commitment to ensure compliance, followed up on the IP's findings and remedied the breach. Therefore, the IP will not impose additional measures to eliminate the violation, as follows from point 2 of the sentence of this decision. 3 Costs 14. No special costs were incurred in this control procedure (point 4 of the pronouncement of the decision). The applicant and the operator shall bear their own costs, which may have been incurred by them as a result of the procedure (second paragraph of Article 30 of ZVOP-2). 15. Since in accordance with the provisions of Article 57(3) of the General Regulation, the performance of the tasks of each supervisory authority (including the consideration of applications submitted by the applicant to whom personal data refer under point (f) of Article 57(1) of the General Regulation) for of the individual to whom the personal data relates, free of charge and because, on the basis of the second paragraph of Article 55 of ZVOP 2, the supervisory authority carries out the powers and duties from the first paragraph of Article 55 of ZVOP 2, which also include decision-making in the application procedures of applicants with special status, free of charge , regardless of the provisions of the Administrative Fees Act (ZUT), this decision is also tax-free. 4 Lessons on the legal remedy: An appeal against this decision is not allowed, but a lawsuit is admissible, which is filed within 30 days of receiving this decision and decision to the Administrative Court in Ljubljana, Fajfarjeva 33, Ljubljana, in writing directly to the said court or by registered mail or orally on the record. If the claim is sent by registered mail, it is considered to have arrived on time if it was sent to the post on the last day of the deadline for filing the claim. The lawsuit with any attachments shall be submitted in at least three copies. This decision or decision in the original or a copy must also be attached to the lawsuit and the court fee must be paid. Anže Novak, state supervisor for the protection of personal data Send: 1. to the applicant - in person according to ZUP; 2. to the supervised operator - personally according to ZUP.
