Slovenia: new Personal Data Protection Act (ZVOP-2) comes into effect on the 26th of January 2023
One of the main changes from which an obligation for the controller of the data originates, is that the controller will need to keep a processing log when he is going to carry out large-scale processing of special categories of personal data and/or regularly and systematically monitor individuals with automated systems. In the log, certain legally required information will need to be kept. The controller is going to have to keep the log for two years from the end of a calendar year. The logs must be aligned with the Act in two years’ time, meaning until 26th of January 2025 at the latest.
The new Act also sets new requirements for the natural and/or legal persons who independently advise to the controller or processor. Such a person is going to have to be contractually capable, have knowledge of or practical experience in the field of personal data protection and not be found guilty of a crime punishable by more than six months of imprisonment.
To conclude, the Act also states that if the personal data is considered public by the Act, then the subject from which the data originates, does not have to be informed or provided with information about the processing of the personal data in accordance with Articles 13 and 14 of the GDPR.
May the reader be warned that the short notice does not take into account all the novelties introduced with the new ZVOP-2!
In need of further information or help in connection with personal data protection as a company in Slovenia or on the Slovenian market? Do not hesitate to contact the ALG partner in Slovenia – Odvetniška družba Završek & Šnajder o.p., d.o.o.
