[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9QUDWCDoeRZMiGWFNvWg3J6Fv_fPYF2Hck1cIDLY9PY":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"f7a17888-6e81-47d5-8e28-e7e145a6d43a","IP (Slovenia) - 06111-65\u002F2023\u002F12","ip-slovenia-06111-65-2023-12-914884","Created page with \"{{DPAdecisionBOX |Jurisdiction=Slovenia |DPA-BG-Color= |DPAlogo=LogoSI.png |DPA_Abbrevation=IP |DPA_With_Country=IP (Slovenia) |Case_Number_Name=06111-65\u002F2023\u002F12 |ECLI= |Original_Source_Name_1=https:\u002F\u002Fwww.ip-rs.si\u002Fvarstvo-osebnih-podatkov\u002Fpraksa-ip |Original_Source_Link_1=https:\u002F\u002Fwww.ip-rs.si\u002Fvarstvo-osebnih-podatkov\u002Fpraksa-ip |Original_Source_Language_1=Slovenian |Original_Source_Language__Code_1=SL |Original_Source_Name_2= |Original_Source_Link_2= |Original_Sourc...\" Show changes","The Information Commissioner (IP) in Slovenia ruled that an employer violated GDPR by accessing and forwarding emails from an employee's work account during their prolonged absence. The employer claimed business continuity, but the DPA found the measure disproportionate and lacking a valid legal basis, especially since less intrusive options like automatic replies were available and no evidence of a legitimate interests assessment was provided.","Slovenian DPA finds employer violated GDPR by accessing and forwarding employee's emails during absence.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=IP_(Slovenia)_-_06111-65\u002F2023\u002F12&diff=53557&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F78\u002FLogoSI.png","2026-10-30T14:22:52+00:00","2026-10-30T15:00:15.408035+00:00",7,[17],{"name":18,"type":19},"IP (Slovenia)","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":60},"slovenian-dpa-finds-employers-access-to-employee-emails-during-absence-violated-gdpr","Slovenian DPA Finds Employer's Access to Employee Emails During Absence Violated GDPR","An employer in Slovenia accessed and forwarded a staff member's work emails during a prolonged absence, citing business continuity — without conducting a legitimate interests assessment or considering less invasive alternatives. The Information Commissioner ruled this disproportionate and lacking a valid legal basis under GDPR, highlighting that even well-intentioned workplace actions must be grounded in documented, proportionate legal justification. This case illustrates that business continuity needs do not override employees' privacy rights when simpler measures (such as auto-replies or delegation policies) are available. Organisations that fail to formalise procedures for accessing employee accounts expose themselves to regulatory sanction and reputational harm.",[53,54,55,56,57,58,59],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management",{"GDPR Article 32":61,"NIST SP 800-53 SI-2: Flaw Remediation":62,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":63,"CIS Control 17: Incident Response Management":64,"CIS Control 14: Security Awareness and Skills Training":65,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":66,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":67},"Article 32 requires appropriate technical and organisational measures to ensure data processing respects individuals' rights; the employer lacked any organisational procedure to ensure proportionate, lawful access to employee emails.","While primarily a technical control, SI-2's broader principle of identifying and correcting process deficiencies applies here — the employer had no corrective policy in place to address the procedural gap of employee absence email handling before a violation occurred.","Clause 7.2 requires that personnel are competent in roles affecting information security; HR and management staff clearly lacked training on GDPR proportionality requirements before making the decision to access and forward the employee's emails.","A defined incident and exception-handling process (including employee absence scenarios) would have provided a documented, reviewed procedure instead of an ad-hoc and ultimately unlawful decision to access the employee's email account.","Structured privacy and data protection training for HR and management — as mandated by this control — would have equipped decision-makers to identify less intrusive alternatives and the legal requirements before accessing employee communications.","Beyond technical vulnerabilities, 27001's governance ethos requires managing process weaknesses; the absence of an absence-management email policy was an organisational vulnerability that led directly to a privacy breach.","This function requires that access to assets is managed and limited to authorised users for authorised purposes; accessing another employee's email without a documented legal basis and proper authorisation directly violates this principle."]