GDPR Fines

A public record of GDPR enforcement across Europe — compiled by INPLP members

Municipality Veľká Lomnica

Country
Slovakia
Fine
The Authority did not impose a measure to remedy the identified deficiencies
Date
2019-02-11
Sector
The basic role of the municipality in the exercise of self-government is to care for the versatile development of its territory and the needs of its inhabitants
Articles
Article 10 section 2 of the Act 122/2013 on personal data protection

The municipality of Veľká Lomnica violated the proposer's right to protection against unauthorized disclosure of information about the proposer by publishing a statement containing the proposer's personal information.

The applicant signed a petition addressed to the municipal council of the municipality Veľká Lomnica. The applicant's personal data from the petition and the personal data of other residents were published on the official notice board and on the Municipality's website. The Office considered that the Municipality Veľká Lomnica had violated the law by unlawfully disclosing this information from its information system of the petitioner and other persons, although Act No. 85/1990 does not provide for the purpose of disclosing the personal data of the petition's supporters, nor does it provide for a list of the personal data of the petition's supporters that may be disclosed. The Office has not imposed any measures on the operator to remedy the deficiencies found, since the personal data in question are no longer published. In the present proceedings, the Office did not agree with the Controller's view that he was obliged under Law No 85/1990 to publish the result of the application as he did. The Office stated that the obligation to publish the result of the application does not affect the obligation arising from a special regulation and thus the obligation under Law No 122/2013 on the protection of personal data. For this reason, the provisions of Law No 85/1990 do not constitute a legal basis that would allow the operator to disclose the personal data of the supporters of the petition contrary to the requirements of Law No 122/2013. Similarly, the Office considered that the right to invite other persons to support the petition by signature and to provide signatures for that purpose in publicly accessible places does not imply the power of an authority to which the petition is addressed to disclose information about the persons supporting it.

Additional information

In the present proceedings the Office did not agree with the controller's opinion that he was within the meaning of Act no. 85/1990 obliged to publish the result of the petition as he did. The Office stated that the obligation to disclose the outcome of the petition is without prejudice to the obligation under a special regulation, and therefore the obligation under Act no. 122/2013 on personal data protection. For this reason provisions of Act no. 85/1990 does not constitute a legal basis which would allow the operator to disclose personal data of supporters of the petition contrary to the requirements of Act 122/2013. Similarly, the Office was of the opinion, that from the right to invite others to support the petition by signing it and to that end issue signatures in places accessible to the public, it is not possible to infer the authority of a public authority, to whom the petition was delivered, to disclose information about the persons supporting it.