IP (Slovenia) - 07100-17-2023-7: Difference between revisions

Revision as of 10:38, 19 December 2023

IP - 07100-17-2023-7

Authority:	IP (Slovenia)
Jurisdiction:	Slovenia
Relevant Law:	Article 12 ZVOP-2 Article 14 ZVOP-2 Article 15 ZVOP-2
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	25.10.2023
Published:	18.12.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	07100-17-2023-7
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Slovenian
Original Source:	Informacijski pooblaščenec (in SL)
Initial Contributor:	ar

The Slovenian DPA decided that while the controller did not comply with the access request when the complaint was filed, it later remedied the breach by providing the complainant information regarding his application process for a public tender.

English Summary

Facts

On 14 July 2023, the Slovenian DPA received a complaint from a data subject alleging a violation of his right to access by the controller. The complainant alleged that the controller had refused to grant him access to his data relating to the application process for a public tender on the basis of professional secrecy.

The DPA noted that the controller had not yet provided the applicant with all the personal data requested. Nonetheless, given that during the proceedings, an individual has the right to be informed of the controller's response but not of the personal data covered by the complaint, the DPA asked the controller whether it could provide the complainant with the full response to the complaint, which would imply that the controller implicitly complied with the request. On 25 August 2023, the controller provided an affirmative response. Thus, on 20 September 2023, the DPA invited the complainant to inform it within ten days whether he wanted to withdraw the complaint or maintain it since he received all the requested personal data. The complainant did not respond to the DPA’s query.

Holding

From the access request made by the complainant on 1 May 2023 and subsequent correspondence with the data controller, the DPA noted that the complainant requested from the controller: information about the score obtained and the assessment process, information on what his ranking was, and the number of points compared to the possible number of points in the written test.

On the basis of the information, the DPA concluded that the controller did not comply with the complainant's access request at the time of the submission of the request, on 14 July 2023, thus breaching Article 15 of the National Data Protection Act 2022 (ZVOP-2) in conjunction with Articles 12 and 14 ZVOP-2. However, the DPA acknowledged that the controller had subsequently fulfilled its obligations under Articles 12, 14 and 15 ZVOP-2 since it had given the complainant access to all the personal data requested: it had communicated the total number of points and the ranking to the complainant, with further explanations.

As the complainant did not respond to the request for declaration within the deadline and the controller did not send any comments, the DPA considered that the controller, following the DPA's inquiry, had subsequently remedied its breach of the right of access and provided the complainant with all the personal data requested.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.

@@ Line 75: / Line 75: @@
 From the access request made by the complainant on 1 May 2023 and subsequent correspondence with the data controller, the DPA noted that the complainant requested from the controller: information about the score obtained and the assessment process, information on what his ranking was, and the number of points compared to the possible number of points in the written test.
-On the basis of the information, the DPA concluded that the controller did not comply with the complainant's access request at the time of the submission of the request, on 14 July 2023, thus breaching Article 15 of the National Data Protection Act 2022 (ZVOP-2) in conjunction with Articles 12 and 14 ZVOP-2. However, the DPA acknowledged that the controller had subsequently fulfilled its obligations under Articles 12, 14 and 15 ZVOP-2 since it had given the complainant access to all the personal data requested: it had communicated the total number of points and the ranking to the complainant, with further explanations.
+On the basis of the information, the DPA concluded that the controller did not comply with the complainant's access request at the time of the submission of the request, on 14 July 2023, thus breaching [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Article 15 of the National Data Protection Act 2022 (ZVOP-2)] in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 ZVOP-2]. However, the DPA acknowledged that the controller had subsequently fulfilled its obligations under [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12, 14 and 15 ZVOP-2] since it had given the complainant access to all the personal data requested: it had communicated the total number of points and the ranking to the complainant, with further explanations.
 As the complainant did not respond to the request for declaration within the deadline and the controller did not send any comments, the DPA considered that the controller, following the DPA's inquiry, had subsequently remedied its breach of the right of access and provided the complainant with all the personal data requested.