IP (Slovenia) - 0612-91/2025/40
Slovenian DPA orders controller to identify and inform data subjects affected by a data breach.
Slovenia's Information Protection Agency (IP) has ordered a controller, presumed to be a public institution, to take corrective measures following a data breach. The controller failed to properly identify affected data subjects and respond to their access requests, providing vague responses instead of explicit confirmation. The IP found violations of GDPR Articles 13, 15, 32, and 34, mandating the controller to implement an appropriate access policy and clearly inform individuals about their involvement in the breach.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IP (Slovenia)?
Get an email when a new story names IP (Slovenia), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Slovenian public institution suffered a data breach and compounded the harm by failing to properly identify which individuals were affected and providing vague, non-committal responses to their GDPR Article 15 access requests. This violated multiple GDPR obligations — including transparency (Article 13), right of access (Article 15), security measures (Article 32), and breach notification to data subjects (Article 34). The case illustrates that a breach itself is only part of the problem; inadequate post-breach processes and poor data subject communication can independently constitute serious regulatory violations. Organizations must have pre-defined procedures for mapping affected individuals quickly and communicating with them clearly and promptly.