Subject Access Request

Opozorilo: Mnenje je bilo izdano na podlagi določb Zakona o varstvu osebnih podatkov (ZVOP-1, Uradni list RS, št. 94/07 - uradno prečiščeno besedilo), ki je z dnem 26. 1. 2023 prenehal veljati in ga je nadomestil nov Zakon o varstvu osebnih podatkov (ZVOP-2, Uradni list RS, št. 163/22), zato mnenje ni več nujno aktualno. Mnenja po ZVOP-2 so na voljo tukaj.

The Information Commissioner of the Republic of Slovenia received your email of 30 November 2022.

...

We should explain that in accordance with the GDPR and the Information Commissioner Act, the Slovenian Information Commissioner is a supervisory authority, who may – in the context of protection of Article 15 rights – handle data subject’s complaints against the refusal of their subject access request as a complaints authority and is not competent to handle data subject requests at a first instance. Data subject requests should be filed with a controller who likely processes data subject’s personal data, whereas the complaint against a refusal of an Article 15 right may be filed with the Information Commissioner.

...

In the event the controller fails to respond to your client’s subject access request within one month or refuses his right in accordance with Article 12 of the GDPR, you are welcome to seek help from the Information Commissioner in a complaint procedure.

Yours sincerely,

Mojca Prelesnik, univ.dipl.prav.,                                                 

Information Commissioner

Prepared by:                                                                                                                            

Polona Merc, LLM

Personal Data Protection Adviser