News

GDPR knows no exceptions: Neither cities nor giants are safe!

The Office for Personal Data Protection of the Slovak Republic recently ruled in two cases that clearly show neither cities nor large companies are immune to the strict rules of the GDPR. From attendance records in public administration to handling customer requests, even seemingly routine procedures can reveal serious personal data protection violations.

In its first decision, the Office ruled on the complaint of an employee against the City of Stupava. The employee objected that, from 2019 until February 2025, the city had used an attendance system that, when recording arrivals and departures, also captured a facial photograph. He claimed that he had never given consent for this and considered it to be harassing.

The City of Stupava argued that it used the system in compliance with § 99 of the Labour Code, which imposes an obligation to keep records of working time. In addition, the city argued that photographs were processed on the basis of legitimate interest. According to the city, the processing was intended to prevent fraudulent attendance reporting, which had occurred in the past. The city also stated that the photographs were not further processed technically, and therefore were not biometric data.

The Office assessed whether the controller had a valid legal basis for the processing of data. It concluded that the legal obligation under the Labour Code applies only to keeping records of working time and does not require the processing of photographs. It likewise rejected the city’s argument of legitimate interest, as the city had not submitted a proportionality test or any other documents justifying the need to process photographs. The Office noted that attendance could have been monitored by other, less intrusive means.

An important factor was that the city only stopped processing photographs after the Office had initiated proceedings. According to the Office, this confirmed that the processing had not been necessary. Moreover, employees, as the weaker party in the employment relationship, could not realistically refuse such processing, which further highlighted the unlawful nature of the city’s conduct.

The Office therefore found a breach of the principle of lawfulness of processing under Article 5(1)(a) GDPR and the obligation to have a legal basis under Article 6 GDPR. This constitutes one of the most serious violations, which can be sanctioned with high fines. In this case, however, the Office took the circumstances into account and set the fine at €1,500. No remedial measures were imposed, as the processing had already ceased.

This decision clearly confirms that employers may only process data that are truly necessary to fulfil their obligations. Photographing employees for attendance purposes does not meet this condition, and without a legal basis, it constitutes a GDPR violation.

In its second decision, the Office for Personal Data Protection of the Slovak Republic imposed a fine of €3,000 on Orange Slovensko, a.s. for failing to properly and fully respond to a customer’s request for access to personal data. The decision concerns the data subject’s right under Article 15 GDPR, one of the core rights guaranteed by the regulation.

The customer requested that the operator provide all personal data processed about him, including information on the legal basis and retention period. At the same time, he withdrew his consent for the processing of his email address. Orange responded with a letter, but in it provided incorrect and contradictory information. For example, it claimed not to hold the customer’s telephone number or email address, yet simultaneously cited a transcript of a telephone conversation and justified sending an empty email to his address. The Office found that the operator had thereby in fact confirmed the processing of these data, even though it had officially stated they were not recorded.

According to the Office, this resulted in multiple GDPR violations. The controller failed to provide the data subject with complete and truthful information, thereby breaching the principle of transparency under Article 5(1)(a) GDPR. It also failed to properly handle the request under Article 15 GDPR and did not comply with Article 12 GDPR, which requires that information be provided clearly, intelligibly, and within the prescribed time limit. The Office further stressed that even if a data subject withdraws consent, the controller must indicate another legal basis for processing if it continues to process the data – for example, performance of a contract or legitimate interest.

For these shortcomings, the Office ordered Orange to fulfil the customer’s request in full and inform the Office of the measures taken. It also imposed an obligation to pay a €3,000 fine. The sanction was imposed despite the fact that it concerned only one customer and no material harm was proven. The Office emphasized, however, that the operator’s inconsistent approach and template-like handling of data subject rights undermines trust in personal data protection and must be penalized.

This decision has significance beyond the specific case. It demonstrates that the right of access to personal data is one of the pillars of the GDPR and cannot be dismissed with a formal or incomplete response. Controllers must thoroughly verify what data they actually process and provide consistent and accurate information. If contradictions appear in their response, the Office will regard this as a breach of obligations, carrying the risk of financial penalties.

 

Article provided by INPLP members: Miroslav Chlipala (BCH Advokáti Chlipala, Slovakia)

 

 

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)