The territorial scope of the ZVOP-1 is governed by its Art. 5, which transposed Art. 4 of the Data Protection Directive into Slovenian law. Hence, the ZVOP-1 is applicable to the processing of personal data in the following cases:
- if data is processed by a controller established in Slovenia, and
- in case the controller is not established in the European Union or European Economic Area, if data is processed using automated or other equipment located in Slovenia, except where such equipment is used solely for the transfer of personal data across the territory of Slovenia. In this case, the controller must appoint a representative that has its seat or is registered in Slovenia.
It has to be noted that the above-mentioned rules on territorial applicability only apply with regard to the provisions of the ZVOP-1 that have not been precluded by the GDPR. In case the GDPR is applicable, the territorial scope is determined based on Art. 3 thereof.
Applicability of the Slovenia’s data protection legislation to deceased persons
According to Art. 23 ZVOP-1, a data controller may supply data relating to a deceased individual only to data recipients authorised to process such data by statute. Furthermore, data of deceased individuals may be supplied to their legal heirs of the first or second order provided that they demonstrate a lawful interest in the use of personal data and unless the deceased individual prohibited in writing the sharing of her/his personal data.
