[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQttIeeyqA7mQjaj-Tz7bdavYsXWVkB0P5U6C-8Peah4":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"ec2bf5b1-3eac-465d-b995-51851b069676","IP (Slovenia) - 0612-91\u002F2025\u002F40","ip-slovenia-0612-91-2025-40-c05527","Fixed language tag ← Older revision Revision as of 06:45, 23 September 2026 Line 13: Line 13: |Original_Source_Link_1=https:\u002F\u002Fwww.ip-rs.si\u002Fvarstvo-osebnih-podatkov\u002Fpraksa-ip |Original_Source_Link_1=https:\u002F\u002Fwww.ip-rs.si\u002Fvarstvo-osebnih-podatkov\u002Fpraksa-ip |Original_Source_Language_1=Slovenian |Original_Source_Language_1=Slovenian |Original_Source_Language__Code_1=SL |Original_Source_Language__Code_1= |Type=Investigation |Type=Investigation Line 61: Line 61: |Initial_Contributor=dt |Initial_Contributor=dt | | |Original_Source_Language_2=SL}} |Original_Source_Language_2=}} The DPA ordered a controller to take measures to identify which data subjects were affected by a data breach and to properly respond to their access requests by explicitly informing them whether they were affected by the data breach. The DPA ordered a controller to take measures to identify which data subjects were affected by a data breach and to properly respond to their access requests by explicitly informing them whether they were affected by the data breach.","Slovenia's Information Protection Agency (IP) has ordered a controller, presumed to be a public institution, to take corrective measures following a data breach. The controller failed to properly identify affected data subjects and respond to their access requests, providing vague responses instead of explicit confirmation. The IP found violations of GDPR Articles 13, 15, 32, and 34, mandating the controller to implement an appropriate access policy and clearly inform individuals about their involvement in the breach.","Slovenian DPA orders controller to identify and inform data subjects affected by a data breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=IP_(Slovenia)_-_0612-91\u002F2025\u002F40&diff=53164&oldid=52124","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F78\u002FLogoSI.png","2026-09-23T06:45:31+00:00","2026-09-23T08:00:09.411889+00:00",7,[17],{"name":18,"type":19},"IP (Slovenia)","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":63},"slovenian-institution-fails-to-identify-breach-victims-or-honor-access-rights","Slovenian Institution Fails to Identify Breach Victims or Honor Access Rights","A Slovenian public institution suffered a data breach and compounded the harm by failing to properly identify which individuals were affected and providing vague, non-committal responses to their GDPR Article 15 access requests. This violated multiple GDPR obligations — including transparency (Article 13), right of access (Article 15), security measures (Article 32), and breach notification to data subjects (Article 34). The case illustrates that a breach itself is only part of the problem; inadequate post-breach processes and poor data subject communication can independently constitute serious regulatory violations. Organizations must have pre-defined procedures for mapping affected individuals quickly and communicating with them clearly and promptly.",[53,54,55,56,57,58,59,60,61,62],"GDPR Article 13 – Transparency and information obligations","GDPR Article 15 – Right of access by the data subject","GDPR Article 32 – Security of processing","GDPR Article 34 – Communication of a personal data breach to the data subject","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","NIST PR.IP-9 – Response plans are in place and managed","NIST RS.CO-3 – Information is shared consistent with response plans","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and protection of PII","ITIL 4 – Incident Management Practice",{}]