Background information
- Date of final decision: 2 December 2021 (inspection) and 13 September 2022 (offence)
- Controller: Public penal institution (prison)
- Legal Reference: National Law (Act on the Protection of Personal Data in the Area of Treatment of Criminal Offences)
- Decision: Rejection of the appeal
- Key words: Right of access by the data subject
Summary of the Decision
Origin of the case
The applicant requested a copy of video recordings of his movement in block 1 of a prison for a certain date and period of time. The controller rejected his request on the grounds of Article 25 of the Act on the Protection of Personal Data in the Area of Treatment of Criminal Offences, providing that the law can partially or completely restrict the right of access by a data subject, inter alia, when it could prevent the obstruction or interference with official procedures and for the protection or exercise of human rights and fundamental freedoms of third parties.
The controller also argued that his internal video surveillance rules provide that video recordings are marked as classified. According to the national Classified Information Act, only persons who have a permission and have to be informed for the performance of their duties, can access classified data.
Key Findings
Slovenian Supervisory Authority, SA determined that the video recordings in question do not exist. According to controller’s internal rules the data must be kept at least 20 days and maximum one year. Video recordings were actually stored for a period of one month, after one month they were automatically deleted. Slovenian SA could not assess the controller’s claims on possible grounds for restriction of the right to access, because for full examination the video recordings should have been submitted to the SA.
Decision
Slovenian SA rejected the appeal of the individual, but started an offence proceeding against the controller. Slovenian SA found that the director of the prison is responsible for not implementing technical and organisational measures appropriate to ensure the video recordings, after receiving an access request, would not be deleted. The director as person responsible was aware of the request of the individual and taking into account the fact that the recordings were still existing on the day when the request was submitted, he allowed the recordings to be automatically deleted. Taking all circumstances of the offence into account, Slovenian SA issued the director a warning.
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.