IP (Slovenia) - 0603-46/2023/13

IP - 0603-46/2023/13
Authority:	IP (Slovenia)
Jurisdiction:	Slovenia
Relevant Law:	Article 13 GDPR Article 100(1)(2) ZVOP-1 Article 100(3) ZVOP-1 Article 76(3) ZVOP-1
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	26.10.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	0603-46/2023/13
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Slovenian
Original Source:	Informacijski Pooblaščenec (IP) (in SL)
Initial Contributor:	Sara Horvat

The DPA found the controller to have failed to ensure that the published video surveillance notice on its premises was displayed in a way to enable an individual to become aware of the video surveillance and to not enter the area surveilled.

English Summary

Facts

The Data controller had his premises under video surveillance, there was a notice of video surveillance, but it was not placed in a way that would make it for an individual possible to be informed about the surveillance before entering the premises and to decide to not be in the area of video surveillance.

The national data privacy legislation (Zakon o varstvu osebnih podatko - ZVOP-2) regulates in Article 76(3) ZVOP-2 the provisions of a notice in the case of video surveillance, the controller must ensure that the notice includes information required upon Article 13 GDPR and also a written or unambiguous graphic description of the fact that video surveillance is being carried out, the purposes of the processing, the name of the controller of the video surveillance system, a telephone number or an e-mail address or a website address to exercise the data subject's rights in the field of the protection of personal data, information on the specific impact of the processing, in particular further processing, the contact details of the authorized person (telephone number or e-mail address) and information about unusual further processing, such as transfers to third country entities, live monitoring and the possibility of audio intervention in case of live monitoring.

Holding

The DPA held in their decision that the data controller had failed to comply with their duty to ensure that the published video surveillance notice was prominently and conspicuously displayed in such a way as to enable the individual to become aware that video surveillance was being carried out and to be able to decide to not to enter the surveillance area because, on the day of the investigation, the video surveillance notice was not placed in a position before entering the area. Therefore this was a breach of Article 76(3) ZVOP-2.

The national data privacy legislation (Zakon o varstvu osebnih podatko - ZVOP-2) regulates in Article 76(3) ZVOP-2 the provisions of a notice in the case of video surveillance, the controller must ensure that the notice includes information required upon Article 13 GDPR and also a written or unambiguous graphic description of the fact that video surveillance is being carried out, the purposes of the processing, the name of the controller of the video surveillance system, a telephone number or an e-mail address or a website address to exercise the data subject's rights in the field of the protection of personal data, information on the specific impact of the processing, in particular further processing, the contact details of the authorized person (telephone number or e-mail address) and information about unusual further processing, such as transfers to third country entities, live monitoring and the possibility of audio intervention in case of live monitoring.

The DPA held the controller responsible upon Article 100(1)(2) ZVOP-2 and the person in charge responsible upon Article 100(3) ZVOP-2 in connection with Article 100(1)(2) ZVOP-2 for an Offence and imposed a legal notice.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.

Number: 0603-46/2023/13
Date: 26 October 2023

The Information Commissioner (hereinafter: the misdemeanor authority) issues through an authorized official..., the State Supervisor for the Protection of Personal Data, ex officio on the basis of the second paragraph of Article 51 and Article 46 of the Act on Misdemeanors (Official Gazette of the Republic of Slovenia, No. 29/11 - official consolidated text, 21/13, 111/13, 74/14 - US Sec, 92/14 - US Sec, 32/16, 15/17 - US Sec, 73/19 - US Sec, 175 /20 – ZIUOPDVE and 5/21 – odl. US; hereinafter: ZP-1), and Articles 2 and 8 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, no. 113/05 and 51/07 – ZUstS-A ; hereinafter: ZInfP), in proceedings on a misdemeanor against a legal entity... (registered number: ...) and its responsible person..., due to a misdemeanor under the first paragraph of Article 100 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163) /22, hereinafter: ZVOP-2), next



DECISION ON OFFENSE



Violator:

1. responsible person: ...

is responsible

for a misdemeanor

according to the third paragraph of Article 100 of ZVOP-2 in relation to point 2 of the first paragraph of Article 100 of ZVOP-2,

which he did by failing to ensure that, as a responsible person of a legal entity..., during the implementation of video surveillance in... on the premises..., on... to become familiar with the implementation of video surveillance and that entry into the controlled area may be refused because the video surveillance notification on the day of the visit on ... was not placed in place before entering the area, i.e. the main entrance to the facility, where video surveillance was carried out, as the notice was only found ... when video surveillance was already being carried out on individuals entering the facility, and video surveillance was also carried out with a camera marked as ..., which violated the provision of the third paragraph of Article 76 of ZVOP-2.

... committed the offense described above in the performance of activities and in the name and with the means of a legal entity ... in which he was authorized to perform work and tasks ... and as a director was obliged to ensure the implementation of video surveillance in accordance with the provisions of ZVOP-2, as a result of which on the basis of the first paragraph of Article 15 of the ZP-1 and the first paragraph of Article 15.a of the ZP-1, he is responsible for the said offense as a responsible person of a legal entity...

2. responsible legal entity: ...

is responsible

for a misdemeanor

according to point 2 of the first paragraph of Article 100 of ZVOP-2,

which he did... by not ensuring that the published video surveillance notice was visibly and distinctly published in a way that would allow an individual , to become familiar with the implementation of video surveillance and that entry into the controlled area may be refused because the notification about video surveillance on the day of the visit on ... was not placed in the place before entering the area, i.e. ... video surveillance was also carried out with a camera marked as ..., which violated the provision of the third paragraph of Article 76 of ZVOP-2.

... committed the described offense in the performance of activities and in the name and with the means of a legal entity ... for which he was authorized to perform work and tasks ... and as director was obliged to ensure the implementation of video surveillance in accordance with the provisions of ZVOP-2, as a result of which the legal entity ..., in accordance with the first paragraph of Article 14 of ZP-1, is liable as a responsible legal entity for the listed offences.

Therefore, on the basis of the third paragraph of Article 100 in relation to point 2 of the first paragraph of Article 100 of the ZVOP-2, responsible legal persons on the basis of the 2nd point of the first paragraph of Article 100 of the ZVOP-2 and when applying the first and the second paragraph of Article 26 and the first paragraph of Article 21 of ZP-1


and with words


1. to the responsible person of the legal entity...: REMINDER;

2. to legal entities...: REMINDER.


Based on the first paragraph of Article 143, in relation to the first paragraph of Article 144 and the second paragraph of Article 58 of the ZP-1, the violator responsible person must pay a court fee in the amount of EUR 30.00. The court fee, which is assessed to the violator for the reprimand in accordance with tariff number 8112 of the Court Fees Act (Official Gazette of the Republic of Slovenia, No. 37/08, with sp., hereinafter: ZST-1) in the amount of 30.00 euros, must be paid by the violator as responsible person to pay to the recipient's account: ...

The infringing responsible legal entity ... must pay a court fee in the amount of 30.00 euros based on the first paragraph of Article 143 in relation to the first paragraph of Article 144 and the second paragraph of Article 58 of the ZP-1. The court fee, which is assessed to the violator for the issued warning under tariff number 8112 ZST-1 in the amount of 30.00 euros, must be paid by the violator as a responsible legal entity to the recipient's account: ...

Violators must pay the court fee within fifteen (15) days after the decision on the offense becomes final. After the deadline for payment has passed, offenders can apply to the authority responsible for forced recovery (Financial Administration of the Republic of Slovenia) to pay the fine and the costs of the procedure (court fees) in installments.

If the legal entity and the responsible party do not pay the costs of the procedure (court fees) within the specified period, the costs of the procedure (court fees) will be forcibly recovered.

LEGAL LESSON: A request for judicial protection is allowed against a decision on a misdemeanor. The request must be announced in writing within eight (8) days of receipt of this decision to the Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, otherwise it is considered that the beneficiary of the request (infringer, legal representative or defender) has waived the right to request judicial protection. The notice of request is sent by post or delivered directly in two copies and is considered timely if submitted on the last day of the deadline for submitting the notice of request by registered mail or directly to the authority that issued the decision. The announced filing of a request for judicial protection may be withdrawn until the deadline for filing the announcement of this request expires.

If the beneficiary of the request for judicial protection does not announce or withdraws the announcement within the legal deadline for filing this request, it is considered that he has waived the right to request for judicial protection.

If none of the beneficiaries of the request for judicial protection announces this request, the misdemeanor authority does not make a decision on the offense with reasons, but it is considered that a final decision has been served on the date of service of the decision without reasons, which with the expiration of the deadline for announcing the request for judicial protection becomes final.

When at least one of the beneficiaries of the request for judicial protection announces the filing of this request, a written decision on the offense with reasons is drawn up and sent no later than 30 days after the announcement of the filing of the request for judicial protection is received. In this case, the decision with reasons is served on all beneficiaries of the request for judicial protection.

Under the conditions and in accordance with the regulations governing the financial operations of the offense authority, the violator can also pay the costs of the procedure with a non-cash means of payment.