IP (Slovenia) - 0602-68/2025/18

Summary

The Slovenian Data Protection Authority (DPA) ruled that a data controller violated GDPR Articles 12 and 15. The controller failed to provide a data subject with adequate information on personal data retention periods and denied a request for a copy of a document containing their personal data. The DPA cited a CJEU decision emphasizing that the right to a copy of personal data includes documents, even with third-party data, if necessary for exercising GDPR rights and the impact on others is minimal.

Full text

Help IP (Slovenia) - 0602-68/2025/18: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 12:23, 7 September 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators163 edits Tag: Decisions [1.0] Latest revision as of 12:39, 7 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators163 editsTag: Visual edit (2 intermediate revisions by the same user not shown)Line 36: Line 36: |GDPR_Article_2=Article 15 GDPR|GDPR_Article_2=Article 15(1)(d) GDPR |GDPR_Article_Link_2=Article 15 GDPR|GDPR_Article_Link_2=Article 15 GDPR |GDPR_Article_3=|GDPR_Article_3=Article 15(3) GDPR |GDPR_Article_Link_3=|GDPR_Article_Link_3=Article 15 GDPR |GDPR_Article_4=|GDPR_Article_4= Line 84: Line 84: }}}} The DPA held that the controller had violated Articles 12 and 15 GDPR by not providing the data subject adequate information on the retention period of their personal data and a copy of a document containing their personal data. The DPA held that the controller had violated [[Article 12 GDPR|Articles 12]] and [[Article 15 GDPR|15 GDPR]] by not providing the data subject adequate information on the storage period of their personal data and a copy of a document containing their personal data. == English Summary ==== English Summary == === Facts ====== Facts === The data subject made an access request asking for a copy of their personal data processed by the controller and information on the anticipated retention period of this data. The data subject specifically requested access to a photocopy of a document related to the controller’s defense in another proceeding that also contained personal data of third parties.The data subject made an access request asking for a copy of their personal data processed by the controller and information on the envisaged storage period of this data. The data subject specifically requested access to a photocopy of a document related to the controller’s defense in another proceeding that also contained personal data of third parties. The controller refused to provide a copy of the requested document on the grounds that even a partial disclosure of the document by redacting the personal data of other individuals would disproportionately interfere with the rights of third parties. Regarding the retention period, the controller explained that it retains personal data in accordance with applicable law, which specifies retention periods for specific types of documentation. Following the rejection of the access request, the data subject lodged a complaint with the DPA. The controller refused to provide a copy of the requested document on the grounds that even a partial disclosure of the document by redacting the personal data of other individuals would disproportionately interfere with the rights of third parties. Regarding the storage period, the controller explained that it stores personal data in accordance with applicable law, which specifies storage periods for specific types of documentation. Following the rejection of the access request, the data subject lodged a complaint with the DPA. === Holding ====== Holding === First, the DPA held that the controller had violated Article 15 in conjunction with [[Article 12 GDPR|Article 12 GDPR]] by failing to provide the data subject sufficiently detailed information on the anticipated retention period for their personal data or the criteria used to determine that period. First, the DPA held that the controller had violated [[Article 15 GDPR|Article 15(1)(d) GDPR]] in conjunction with [[Article 12 GDPR]] by failing to provide the data subject sufficiently detailed information on the envisaged storage period for their personal data or the criteria used to determine that period. Second, the DPA concluded that the controller had violated [[Article 15 GDPR|Article 15 GDPR]] by rejecting the data subject’s request for a copy of their personal data. The DPA referred to the CJEU’s decision in the case C-487/21 to support its conclusion. In this decision, the CJEU clarified that the right to obtain a copy of the personal data being processed also includes the right to obtain copies of extracts from documents or entire documents under certain conditions. In the present case, the DPA held that merely providing the data subject a list of their personal data would not enable them to effectively exercise their rights under the GDPR. It also took into account that the document only contained a small amount of third parties’ personal data.Second, the DPA concluded that the controller had violated [[Article 15 GDPR|Article 15(3) GDPR]] by rejecting the data subject’s request for a copy of their personal data. The DPA referred to the CJEU’s decision in the case [[CJEU - C-487/21 - Österreichische Datenschutzbehörde and CRIF|C-487/21 ''Österreichische Datenschutzbehörde and CRIF'']] to support its conclusion. In this decision, the CJEU clarified that the right to obtain a copy of the personal data being processed also includes the right to obtain copies of extracts from documents or entire documents under certain conditions.<ref>The CJEU held that the provision of such a copy must be necessary for the effective exercise of the data subject's rights under the GDPR and that the rights and freedoms of others must also be taken into account; see [[CJEU - C-487/21 - Österreichische Datenschutzbehörde and CRIF|CJEU - C-487/21 - ''Österreichische Datenschutzbehörde and CRIF'']], margin number 45.</ref> In the present case, the DPA held that merely providing the data subject a list of their personal data would not enable them to effectively exercise their rights under the GDPR. It also took into account that the document only contained a small amount of third parties’ personal data. Therefore, the DPA ordered the controller to provide the data subject information on the retention period of the personal data the access request concerned, as well as a copy of the document the data subject had requested with the personal data of third parties redacted. Therefore, the DPA ordered the controller to provide the data subject sufficient information on the storage period of the personal data the access request concerned, as well as a copy of the document the data subject had requested with the personal data of third parties redacted. == Comment ==== Comment == Latest revision as of 12:39, 7 September 2026 IP - 0602-68/2025/18 Authority: IP (Slovenia) Jurisdiction: Slovenia Relevant Law: Article 12 GDPR Article 15(1)(d) GDPR Article 15(3) GDPR Type: Complaint Outcome: Upheld Started: Decided: Published: Fine: n/a Parties: n/a National Case Number/Name: 0602-68/2025/18 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Slovenian Original Source: IP (in SL) Initial Contributor: av The DPA held that the controller had violated Articles 12 and 15 GDPR by not providing the data subject adequate information on the storage period of their personal data and a copy of a document containing their personal data. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The data subject made an access request asking for a copy of their personal data processed by the controller and information on the envisaged storage period of this data. The data subject specifically requested access to a photocopy of a document related to the controller’s defense in another proceeding that also contained personal data of third parties. The controller refused to provide a copy of the requested document on the grounds that even a partial disclosure of the document by redacting the personal data of other individuals would disproportionately interfere with the rights of third parties. Regarding the storage period, the controller explained that it stores personal data in accordance with applicable law

Entities