SloveniaElectronic Communications Act (ZEKom-2), Article 214, Confidentiality of Communications and Recording
214. člen Zakona o elektronskih komunikacijah (ZEKom-2)
In force since .
An interception and recording consent rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Disclosure, Retention
As of .
What it requires
- Do not monitor or intercept communications as a third person who is not a user taking part in the communication, whether by listening, intercepting, recording, storing or passing them on, without the consent of the users concerned, unless this Act allows it or it is strictly needed to carry the message (article 214, paragraph 5).NIST Privacy FrameworkCT.PO-P1
- Do not record or store communications without the prior consent of the participants where such processing is not usual and the participants cannot expect it because of the nature of the communication (article 214, paragraph 6).NIST Privacy FrameworkCT.PO-P1
- You may record communications and the related traffic data in the course of lawful business practice to provide evidence of a market transaction or other business communication only if the parties are told in advance about the recording, its purpose and how long the recording is kept (article 214, paragraph 7).NIST Privacy FrameworkCM.AW-P1
- Delete a recorded message immediately, and at the latest when the time in which the transaction can lawfully be challenged runs out (article 214, paragraph 7).NIST Privacy FrameworkCT.DM-P5
- Give the notice of recording by the same type of medium and in the same form as the recorded communication (article 214, paragraph 8).NIST Privacy FrameworkCM.AW-P1
- If you are an operator, keep the confidentiality of the content of communications, the related traffic and location data, and facts about interrupted or unestablished connections, also after your activity ends, obtain information about communications only as strictly needed to provide the public communications service, and tell the subscriber or user at contract conclusion or service start when you must obtain content or record or store communications (article 214, paragraphs 1 to 4).NIST Privacy FrameworkPR.DS-P2NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P2Data-in-transit are protected.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
Article 299, paragraph 1 fines a legal person EUR 1,000 to EUR 20,000, and EUR 50,000 to EUR 400,000 where it is a medium-sized or large company.
- Rule
- Fixed only
- As of
- Minimum
- 1,000
- Currency
- EUR
- Fixed cap
- 400,000
Who enforces it
Enforcement body
The Agency for Communication Networks and Services of the Republic of Slovenia (agencija) supervises the provisions of this chapter, except those articles that the Information Commissioner supervises (article 229).
Settledness
- As of
- Open questions
- Does 'vsakdo, ki sodeluje pri zagotavljanju in izvajanju njegove dejavnosti' in Article 214(2) of ZEKom-2 reach a business that records its own customers' calls on a telephone line it buys from an operator?
What this law does
Article 214, paragraph 1 of the Electronic Communications Act (ZEKom-2) extends the confidentiality of communications to their content, to the traffic and location data connected with them, and to facts and circumstances concerning an interrupted connection or a connection that was not established. Article 214, paragraph 2 requires the operator and everyone who takes part in its activity to protect the confidentiality of communications even after the activity ends.
Article 214, paragraph 3 lets those bound obtain information about communications only to the extent strictly needed to provide certain public communications services, and use or pass it on only for providing those services.
Article 214, paragraph 4 requires operators that must obtain the content of communications, or record or store communications and related traffic data, to tell the subscriber or user so when the subscription contract is concluded or the service begins, and to delete the content as soon as it is technically feasible and no longer needed for the service.
Article 214, paragraph 5 prohibits all forms of monitoring or interception of communications by third persons who are not users taking part in the communication, such as listening, intercepting, recording, storing and passing on, without the consent of the users concerned, except as paragraph 4 and articles 220 and 228 allow or where strictly needed to carry the message.
Article 214, paragraph 6 prohibits users too from recording and storing communications without the prior consent of the participants where such processing is not usual and the participants cannot expect it because of the nature of the communication.
Article 214, paragraph 7 allows recording of communications and the related traffic data in the course of lawful business practice to provide evidence of a market transaction or any other business communication, on condition that the parties are told in advance about the recording, its purpose and how long the recording is kept.
Article 214, paragraph 7 requires the recorded message to be deleted immediately, and at the latest when the time in which the transaction can lawfully be challenged runs out. Article 214, paragraph 8 requires the notice of recording to be given by the same type of medium and in the same form as the recorded communication. Article 299, paragraph 1 fines a legal person EUR 1,000 to EUR 20,000, or EUR 50,000 to EUR 400,000 where it is a medium-sized or large company, for the breaches it lists.
Article 299, paragraph 1 lists among those breaches obtaining information on communications beyond what is strictly needed, failing to notify the subscriber or delete content, monitoring or intercepting communications where this Act does not expressly allow it, recording and storing communications contrary to paragraph 6, and failing to notify the parties of a recording or deleting the recording on time.
Article 229 has the Agency supervise the provisions of its chapter, except articles 216, 220, 221, 223 and 225, which the Information Commissioner supervises. Article 230 establishes the Agency for Communication Networks and Services of the Republic of Slovenia (Agencija za komunikacijska omrežja in storitve) as a legal person under public law. Article 323 provides that the Act takes effect on the thirtieth day after its publication in Uradni list, which was on .
When LexLint raises it
When your app profile says your app records calls, records text chat or processes voice recordings.