SloveniaElectronic Communications Act (ZEKom-2), Article 225, Cookies: Consent for Storing or Accessing Data in Terminal Equipment
225. člen Zakona o elektronskih komunikacijah (ZEKom-2)
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Obtain the subscriber's or user's consent before storing data in their terminal equipment or gaining access to data stored there, after clearly and comprehensively informing them in advance about the controller and the purposes of processing in line with the personal data protection rules (article 225, paragraph 1).
- No consent is needed for technical storage or access solely to carry a message over an electronic communications network, or where strictly necessary to provide an information society service the subscriber or user expressly requested (article 225, paragraph 2).
- Where it is technically feasible and effective and in line with data protection rules, you can treat suitable browser or other application settings as the user's consent (article 225, paragraph 3).
These lines are LexLint's reading of the law's text, as of . Also read by: Informacijski pooblaščenec (guidance, recorded ); Court of Justice, judgment of , Planet49, C-673/17 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
Article 301, paragraph 1 fines a legal person EUR 200 to EUR 1,000, and EUR 1,000 to EUR 20,000 where it is a medium-sized or large company.
- Rule
- Fixed only
- As of
- Minimum
- 200
- Currency
- EUR
- Fixed cap
- 20,000
Who enforces it
Enforcement body
The Information Commissioner (Informacijski pooblaščenec) carries out inspection supervision of article 225 (article 225, paragraph 5, and article 229).
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673
- Guidance link
- https://www.ip-rs.si/fileadmin/user_upload/Pdf/smernice/SMERNICE%20O%20UPORABI%20PI%C5%A0KOTKOV%20IN%20PODOBNIH%20SLEDILNIH%20TEHNOLOGIJ_2023.pdf
- Case citation
- Court of Justice, judgment of , Planet49, C-673/17
- Guidance body
- Informacijski pooblaščenec
What this law does
Article 225, paragraph 1 of the Electronic Communications Act (Zakon o elektronskih komunikacijah, ZEKom-2) allows storing data in, or gaining access to data stored in, the terminal equipment of a subscriber or user only on condition that the subscriber or user consented after being clearly and comprehensively informed in advance about the controller and the purposes of processing, in accordance with the personal data protection rules.
Article 225, paragraph 2 allows technical storage of or access to data solely to carry a message over an electronic communications network, or where strictly necessary to provide an information society service that the subscriber or user expressly requested. Article 225, paragraph 3 provides that, where technically feasible and effective and in line with data protection rules, the user can also express consent through suitable browser or other application settings.
Article 225, paragraph 4 applies this Act where a breach of the information and consent rules is also a breach of the data protection rules. Article 225, paragraph 5 has the Information Commissioner carry out inspection supervision of the article. Article 301, paragraph 1 fines a legal person EUR 200 to EUR 1,000, or EUR 1,000 to EUR 20,000 where it is a medium-sized or large company, for the breaches it lists.
Article 301, paragraph 1 lists processing a user's data obtained as article 225, paragraph 1 describes, without the user's prior consent and without clear and comprehensive prior information, among those breaches. Article 229 has the Agency supervise the provisions of its chapter, except articles 216, 220, 221, 223 and 225, which the Information Commissioner supervises.
Article 230 establishes the Agency for Communication Networks and Services of the Republic of Slovenia (Agencija za komunikacijska omrežja in storitve) as a legal person under public law. Article 323 provides that the Act takes effect on the thirtieth day after its publication in Uradni list, which was on .
When LexLint raises it
When your app profile says your app tracks devices.