Data Protection Laws and Freedom of Expression: Slovenia
Constitutional/Primary Law Background - see also ECHR and EU Charter
The contemporary Slovenian Constitution (1991 as revised 2016) includes a range of relevant rights including explicit data protection rights. Article 39 guarantees freedom of expression of thought, speech, publication communication (including the press) and establishes that everyone may freely collect, receive and disseminate information. Article 59 also guarantees freedom of scientific and artistic endeavour. Meanwhile, Article 38 guarantees the protection of personal data including judicial protection in the event of abuse, establishes that this subject matter including its supervision shall be regulated by law, prohibits use of personal data contrary to its purpose of collection and provides for the right of access to personal data. Article 35 guarantees the inviolability of privacy and personality rights, article 36 the inviolability of dwellings (with entry against will generally requiring a court order, witnesses and the resident or their representative being present) and article 37 the privacy of communication (with suspension only via a legal authorised court order in the course of criminal proceedings or for national security).
The first relevant protection of freedom of expression, inviolability of domicile and secrecy of letters dates to the Basic Law on the General Rights of the Citizen as promulgated by the Austrian Empire in 1867 (see Austrian Report). Rights to freedom of press including distribution of literature, as well as freedom of learning and the arts, can be found in articles 13 and 16 of the 1921 Yugoslav Constitution. This constitution also protected the inviolability of the home (in article 11) and the privacy/secrecy of communications (letters, telegrams, telephone) (in article 17). The current provisions here trace back to the adoption of the Slovenian Constitution in 1991.
First-Generation Statutory Law
Slovenia adopted the Law on Personal Data Security in 1990.
Special Expression Derogation
No specific provision adopted.
Broad Expression Derogation
No specific provision adopted.
Personal Exemption
No specific provision adopted.
Knowledge Facilitation Framework
Art. 10 provided that a transfer of personal data to other uses was permitted for statistical, scientific research, educational or other similar purposes, if an identification of the ‘individuals concerned’ was not possible. Personal data was also permitted to be transferred abroad, if based on agreements inter alia on scientific cooperation, full protection was guaranteed, the concerned individual consented thereto and the transfer was registered with the Data Protection authority (sec. 26).
|
Second-Generation Statutory Law
A second-generation data protection, the ZVOP 1999, was first adopted on 8 July 1999. A completely updated law was agreed on 15 July 2004 (Personal Data Protection Act 2004)).
Special Expression Derogation
The ZVOP 1999 contained no clearly relevant provisions (but see below under knowledge facilitation for exemptions for museums, libraries, archives etc.).
The 2004 law provide a narrow but unconditional exemption for the media when processing for the purposes of informing the public as regards the DPA notification duty and the international data transfer conditions (art. 7(3)). No specific derogations were set out for other special expressive purposes.
Broad Expression Derogation
The ZVOP 1999 contained no clearly relevant provisions (but see below under knowledge facilitation for exemptions for museums, libraries, archives etc.).
No specific provision adopted.
Personal Exemption
The law did not apply to the processing of personal data performed by individuals exclusively for personal use, family life or other domestic needs (art. 7(1)).
Knowledge Facilitation Framework
The ZVOP 1999 provided a categorical exemption for personal data contained in books, publications, and other materials stored in museums, libraries, archives and similar public which are public and generally accessible (art. 5(4)).The law also enabled personal data to be provided to another for statistical and scientific research purposes (art. 11) and also for sensitive data to be obtained other than from the data subject (art. 8) but in each case only if the data was in a form which did not allow for the identification of individuals (art. 8).The law enabled the central population register to supply names, occupations and addresses of individuals for research samples so long as these individuals had been informed of this possibility in writing and had prohibited this (art. 11).
Art. 17 of the 2004 Act provided for a narrow exemption from the incompatibility principle for the processing of data for historical, statistical and scientific research purposes. This exemption, however, only applied if the respective data are anonymized, unless a statute provided otherwise, or the individual consented to the processing. Results of such processing should only be published in anonymized form, unless otherwise provided by a statute or the individual to which the personal data related gave written consent. No exemptions were provided from the proactive direct or the reactive transparency (subject access) rules, the sensitive information rules or the legitimating grounds, international data transfers or obligation of notification conditions. Unlike in Directive 95/46 itself, the limitation to the proactive indirect transparency rule on grounds of impossibility or disproportionate effort were limited to processing of personal data for historical, statistical or scientific purposes (art. 19(5)).
|
Third-Generation Statutory Law
Slovenia is in the process of adopting third-generation data protection statutory law implementing the GDPR.
|