[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTdop7c1MYkuGHJW0P2Ie32Ohoa9Ek7ZD2QrswTuVhto":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":74},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"7842cdfb-b5cd-490d-8649-5aa7becdb54a","IP (Slovenia) - 0609-113\u002F2025\u002F9","ip-slovenia-0609-113-2025-9-566124","← Older revision Revision as of 13:33, 1 September 2026 Line 84: Line 84: }} }} The DPA fined a company €5,320 for a failure to implement appropriate technical and organisational measures in connection with the destruction of employees' personal data. The DPA fined a company €5,320 for a failure to implement appropriate technical and organisational measures in connection with the destruction of employees' personal data contained in paper documents. Discarded documents were left unsecured and accessible to anyone. == English Summary == == English Summary ==","Slovenia's Information Commissioner (IP) has fined a company €5,320 for failing to implement adequate technical and organizational measures to protect employee personal data. Discarded paper documents containing sensitive information like names, insurance numbers, and addresses were left unsecured and accessible to unauthorized individuals. This violation breaches Articles 32 and 5(1)(f) of the GDPR, emphasizing the need for robust data destruction and confidentiality protocols.","Slovenian DPA fines company €5,320 for unsecured employee personal data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=IP_(Slovenia)_-_0609-113\u002F2025\u002F9&diff=52863&oldid=52840","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F78\u002FLogoSI.png","2026-09-01T13:33:48+00:00","2026-09-01T14:00:19.416476+00:00",7,[17],{"name":18,"type":19},"IP (Slovenia)","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":73},[47],{"slug":48,"name":49,"problem":50,"products":51},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":69,"product_name":70,"url":71,"description":72},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":75,"title":76,"body":77,"framework_refs":78,"framework_notes":87},"5320-gdpr-fine-for-unsecured-discarded-employee-documents-in-slovenia","€5,320 GDPR Fine for Unsecured Discarded Employee Documents in Slovenia","A Slovenian company was fined €5,320 after sensitive employee personal data — including names, insurance numbers, and addresses — was found on discarded paper documents left accessible to unauthorized individuals. The root cause was the absence of adequate technical and organizational measures for secure document disposal, violating GDPR Articles 32 and 5(1)(f). This case highlights that data protection obligations extend beyond digital systems to physical handling and destruction of personal data. Organizations that neglect physical data lifecycle management face both regulatory penalties and serious breaches of employee trust and privacy.",[79,80,81,82,83,84,85,86],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 32 – Security of processing","NIST SP 800-53 MP-6 – Media Sanitization","NIST SP 800-122 – Protection of Personally Identifiable Information (PII)","CIS Control 3.7 – Securely Dispose of Data","ISO\u002FIEC 27001:2022 Annex A 8.10 – Information deletion","ITIL Service Transition – Information Security Management (physical asset disposal)","ICO Accountability Framework – Data Lifecycle Management",{"GDPR Article 32 – Security of processing":88,"NIST SP 800-53 MP-6 – Media Sanitization":89,"CIS Control 3.7 – Securely Dispose of Data":90,"ISO\u002FIEC 27001:2022 Annex A 8.10 – Information deletion":91,"ICO Accountability Framework – Data Lifecycle Management":92,"GDPR Article 5(1)(f) – Integrity and confidentiality principle":93,"NIST SP 800-122 – Protection of Personally Identifiable Information (PII)":94,"ITIL Service Transition – Information Security Management (physical asset disposal)":95},"Security of processing includes organisational measures for secure disposal, such as shredding, which were missing here.","Media sanitisation applies to paper too, requiring documents with insurance numbers and addresses to be shredded rather than discarded.","Secure data disposal, such as shredding or certified destruction, would have prevented employee records being found in the rubbish.","Information deletion requires removing personal data securely when no longer needed, including on paper.","Lifecycle management includes defined retention and secure destruction of records, which would have prevented this exposure.","The confidentiality principle requires protecting employee data throughout its life, including when paper records are thrown away.","PII protection guidance covers secure disposal of records, the control that failed when employee documents were left accessible.","Physical asset disposal procedures ensure paper records with personal data are destroyed securely rather than discarded."]