IP - 07120-1/2021/181

IP - 07120-1/2021/181

Authority:	IP (Slovenia)
Jurisdiction:	Slovenia
Relevant Law:	Article 6 GDPR Art. 6/3 Public Information Access Act
Type:	Advisory Opinion
Outcome:	n/a
Started:
Decided:
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	07120-1/2021/181
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Slovenian
Original Source:	IP (in SL)
Initial Contributor:	GDPR+

IP stated that publication of those parts of the minutes of the meetings of the parents' council (council members and employees of the public institution), which contain only public information, is allowed.

English Summary

Facts

IP received a letter stating that the individual is employed at a primary school where they would like to publish the minutes of the parent council online. Regarding the publication of names and surnames, the individual was interested in how it is with the publication of the names and surnames of teachers in question (praise, criticism). Also, should he enter in the record the full name, only the initials of the specific teacher, or perhaps only the subject he is teaching (to know who / what was being talked about)? The names of students, parents and attendance lists are not published.

Dispute

Holding

The legal basis for the processing of personal data of members of the council of parents and employees of a public institution may be the Access to Public Information Act. Therefore (taking into account exceptions from free access) the publication of minutes of parents' council, which contain only public information, is permissible.

If the minutes of the meetings of the council of the institution or of the parents' council contain protected personal data or other data, the disclosure of which is not admissible (exceptions are specified in paragraphs 5a and 1 of the ZDIJZ), these parts of the minutes must be covered before publication.

Data related to the use of public funds or to the performance of a public function or employment relationship of a civil servant pursuant to the third paragraph of Article 6 of the ZDIJZ do not belong to protected personal data.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.


                    
                    Publication of parent council minutes
                    +
                    -
                    
                    
                        Date: 12.04.2021
                        Number: 07120-1 / 2021/181
                        Categories: Education, World Wide Web
                        The Information Commissioner (hereinafter IP) received your letter by e-mail, in which you explain that you are employed at the primary school where you would like to publish the minutes of the parents' council online. Regarding the publication of names and surnames, you are interested in how it is with the publication of names and surnames of teachers who are discussed at the meeting (praise, criticism…). You ask whether you should enter the full name in the record, only the initials of a specific teacher, or perhaps just the subject he is teaching (to know who / what was being talked about)? You explain that you do not publish the names of students, parents and attendance lists.

On the basis of the information you have provided to us, hereinafter referred to as Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data Directive 95/46 / EC (hereinafter: the General Regulation), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07, official consolidated text, hereinafter ZVOP-1) and 2 Article of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter ZInfP), we provide our non-binding opinion on your question. At the same time, IP emphasizes that it cannot assess specific processing of personal data outside the inspection procedure.

At the outset, we would like to clarify that IP in opinion no. 0712-1 / 2019/1326 of 29 May 2019 has already responded to a very similar or almost identical question as yours (title of the opinion: Request for publication of minutes of parent council meetings). The summary of that opinion states:

The legal basis for the processing of personal data of members of the parents' council and employees of a public institution may be the Access to Public Information Act, therefore (taking into account exceptions to free access) is the publication of those parts of the minutes of the institution's council meetings. parents' council, which contain only freely accessible information of a public nature, is permissible.

If the minutes of the meetings of the council of the institution or parents' councils contain protected personal data or other data, the disclosure of which is not admissible (exceptions are set out in Article 5a and the first paragraph of Article 6 of the ZDIJZ), these parts of the minutes must be covered before publication.

Data related to the use of public funds or the performance of a public function or employment relationship of a civil servant pursuant to the third paragraph of Article 6 of the ZDIJZ do not belong to protected personal data.

Given that you are asking specifically about the discussion about teachers (praise, criticism), as a personal data controller, you must make an assessment of which personal data are related to the use of public funds or to the performance of a public function or employment relationship. admissible publication of personal data as determined by the third paragraph of Article 6 of the ZDIJZ). If certain personal data exceed the threshold of data "related to the use of public funds or to the performance of a public function or employment relationship of a public servant", you must cover them.

If it is not freely accessible personal data, you must cover it with the anonymization technique, according to which it is impossible to identify or recognize the individual, and not with the pseudonymization technique you are asking about (indication of initials, indication of the subject teaches).

In your opinion, the IP cannot give you a specific answer as to where the limit is when the information is no longer related to the performance of a public function or employment relationship of a civil servant, as the possibilities that may appear in the minutes are too many (they can range from possible disciplinary proceedings to processing of personal health data), in addition, the IP is an appellate body in the field of access to public information and cannot comment in advance on such content in the opinion. However, we can direct you to the IP website, which publishes IP practice in the field of public information, where you can select the category "Civil servants, officials" (https://www.ip-rs.si/informacije-javnega-zna% C4% 8Daja / search engine-after-decision% C4% 8Dbah /).

We must also clarify that the IP is competent only for that part of the right to privacy which relates to the protection of personal data and which is regulated by Article 38 of the Constitution of the Republic of Slovenia (Official Gazette of the Republic of Slovenia, No. 33/91-I et seq .; hereinafter referred to as the Constitution of the Republic of Slovenia). The publication of content on the website may not in itself constitute a violation of regulations in the field of personal data protection, but in some cases it may be an interference with the right to privacy in a broader sense from Article 35 of the Constitution, protected by civil and criminal law institutes. before the competent courts, and may also result in criminal and tort liability.

In view of all the above, we summarize that the minutes of the parents' council represent information of a public nature, but in certain parts caution is required in the publication and the assessment must be made regarding each individual part of the individual minutes. However, the assessment must first be carried out by the controller of personal data.

Hoping that you have received an answer to your question, we warmly welcome you.


Mojca Prelesnik, B.Sc.
Information Commissioner

Prepared by:
mag. Polona Merc, Univ. dipl. right,
IP data protection consultant