IP (Slovenia) - 0609-113/2025/9
Slovenian DPA fines company €5,320 for unsecured employee personal data.
Slovenia's Information Commissioner (IP) has fined a company €5,320 for failing to implement adequate technical and organizational measures to protect employee personal data. Discarded paper documents containing sensitive information like names, insurance numbers, and addresses were left unsecured and accessible to unauthorized individuals. This violation breaches Articles 32 and 5(1)(f) of the GDPR, emphasizing the need for robust data destruction and confidentiality protocols.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IP (Slovenia)?
Get an email when a new story names IP (Slovenia), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Slovenian company was fined €5,320 after sensitive employee personal data — including names, insurance numbers, and addresses — was found on discarded paper documents left accessible to unauthorized individuals. The root cause was the absence of adequate technical and organizational measures for secure document disposal, violating GDPR Articles 32 and 5(1)(f). This case highlights that data protection obligations extend beyond digital systems to physical handling and destruction of personal data. Organizations that neglect physical data lifecycle management face both regulatory penalties and serious breaches of employee trust and privacy.
What helps against this
How we list vendors- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.