SloveniaGDPR Articles 12-21 and ZVOP-2 Articles 11 and 69, Data Subject Rights in Slovenia
Regulation (EU) 2016/679, Arts. 12-21; ZVOP-2, Arts. 11, 69
In force since , effective .
A data subject rights rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Slovenia within one month of receipt.
- When you process personal data in Slovenia for scientific, historical or statistical research, honor access and objection requests, and rectification, erasure, restriction or portability requests where exercising them would not jeopardise the research, under ZVOP-2 Article 69(8).
These lines are LexLint's reading of the law's text. Also read by: Informacijski pooblaščenec (Information Commissioner of Slovenia) (guidance, recorded ); Case C-307/22 FT v DW, judgment of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307
- Guidance link
- https://www.ip-rs.si/varstvo-osebnih-podatkov/pravice-posameznika/seznanitev-z-lastnimi-osebnimi-podatki
- Case citation
- Case C-307/22 FT v DW, judgment of (First Chamber)
- Guidance body
- Informacijski pooblaščenec (Information Commissioner of Slovenia)
- Open questions
- When does exercising rectification, erasure, restriction or portability 'jeopardise the purpose of the research' ('ogrozi namena raziskave') so that Article 69(8) of ZVOP-2 bars it?
What it makes you log
Logging duty
Articles 12 to 21 and ZVOP-2 Articles 11 and 69 set how a controller answers a rights request, the court route against a controller and the limits for research. They state no duty to create, keep or produce a log or record of the request or the answer. ZVOP-2 Article 21 bars deleting the processing logs and related information while a rights request is pending, and Article 22 requires a processing log in the cases it names; this row cites neither, so it carries no value from them.
- Kind
- None
- As of
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Slovenia can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.
ZVOP-2 Article 11 lets a person seek judicial protection of these rights against a public or private controller or processor for as long as a violation continues, including damages, without first complaining to the Information Commissioner. Article 69(8) narrows the rights for scientific, historical or statistical research: access and objection remain, and rectification, erasure, restriction and portability apply only where exercising them would not jeopardise the research.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .