Question regarding the applicability of the GDPR when sending letters + - Opozorilo: Mnenje je bilo izdano na podlagi določb Zakona o varstvu osebnih podatkov (ZVOP-1, Uradni list RS, št. 94/07 - uradno prečiščeno besedilo), ki je z dnem
- 2023 prenehal veljati in ga je nadomestil nov Zakon o varstvu osebnih podatkov (ZVOP-2, Uradni list RS, št. 163/22), zato mnenje ni več nujno aktualno. Mnenja po ZVOP-2 so na voljo tukaj. Datum: 14.06.2022 Številka: 07121-1/2022/650 Kategorije: --> Kategorije: Elektronska pošta The Information Commissioner (Slovenian National Supervisory Body for Personal Data Protection, below: IP) received your additional question on whether GDPR applies, if the letter from an EU businessman to the USA owner of the company is not sent on the company’s email but on the private one. *** On the basis of the information you have provided to us, in accordance with Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data Directive 95/46 / EC (hereinafter: the GDPR), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07-UPB1, hereinafter: ZVOP-1) and Article 2 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter: ZInfP), we provide our non-binding opinion regarding your submitted question. GDPR applies fully in all cases where it comes to personal data processing. Individual email addresses undoubtedly represent personal data. When sending e-mails, national regulations adopted on the basis of the ePrivacy Directive also apply. Processing of personal data is the primary task and the responsibility of every individual controller. Explanation: IP additionally clarifies that GDPR is fully applicable in all cases of personal data processing done within the framework of Article 2 of the GDPR. According to Article 4
(2)of the GDPR, data processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The term personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Individual email addresses thus undoubtedly represent personal data. IP also notes, that it is also necessary to take into account national regulations adopted on the basis of the ePrivacy Directive[1] (e.g. Article 158 of Electronic Communications Act - ZEKom-1 in the case of Slovenia regarding direct marketing using electronic communications[2]), as stipulated in paragraph 4, Article 2 of the GDPR. Additionally it should be emphasized, that IP cannot, outside the inspection procedure or other administrative procedure, provide concrete views on individual issues in the field of personal data protection and must not and cannot assume the responsibility of individual controllers for their actions, as is the case with other inspection bodies. Processing of personal data is the primary task and the responsibility of every individual controller. We sincerely hope our answers help you. Mojca Prelesnik Information Commissioner of the Republic of Slovenia Prepared by: Grega Rudolf, assistant legal advisor of the IC [1] Privacy and Electronic Communications Directive 2002/58/EC available here: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058 [2] Unofficial English translation of ZEKom-1 available here: http://www.pisrs.si/Pis.web/npbDocPdf?idPredpisa=ZAKO7224&idPredpisaChng=ZAKO6405&type=doc&lang=EN O NAS Informacijski pooblaščenec Dunajska cesta 22 1000 Ljubljana, Slovenija Zemljevid (vir: najdi.si) Telefon: 01 230 97 30 Poštni in varni e-predal: gp.ip(at)ip-rs.si Odgovorna oseba za informacije za medije: dr. Jelena Virant Burnik. Kontakt za medije: Barbara Repovš, mediji@ip-rs.si ali 01 230 97 30 Prijava kršitev (Navodila in obrazci) URADNE URE PON - PET 9.00 - 12.00 POVEZAVE Informacije javnega značaja Priročniki in smernice Obrazci Politika zasebnosti Informacije o obdelavi osebnih podatkov Izjava o dostopnosti Podpora za majhna podjetja Pravice posameznikov Prijava na prejemanje e-novic Informacijski pooblaščenec | 2026