Support Centre

You have out of 10 free articles left for the week

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Slovenia: Information Commissioner publishes guidelines on the verification of PCT conditions for employers and managers

The Information Commissioner ('the Commissioner') published, on 17 September 2021, guidelines on the verification of morbidity, vaccination, or testing ('the PCT conditions') for employers and managers. In particular, the guidelines state, among others, that employers may process the personal data of their employees if this is necessary for the purposes of exercising the rights and obligations arising from the employment relationship or in connection with the employment relationship under Article 48 of the Employment Relationships Act ('ZDR-1'). Furthermore, the guidelines stated that the Government decrees governing measures to contain the COVID-19 pandemic set out when a worker must comply with the PCT conditions, which means that they regulate additional 'rights and obligations arising from the employment relationship'. Therefore, the guidelines confirmed that the basis for the permissible processing of employees' personal data by verifying the PCT conditions are already in Article 48 of the ZDR-1 in connection with Article 9(2)(b) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). Moreover, the guidelines stated that, with respect to proof of PCT eligibility of visitors and service users, there is an indirect legal basis if, for example, a provision in the relevant legal regulation imposes such a mandatory verification of the fulfillment of the PCT conditions on visitors and users of the services.

Additionally, the guidelines stated that it is the responsibility of each employer to determine internally who actually carries out the verification and when, and to inform the employees. Specifically, the guidelines noted that employers may keep a list of which of the workers meet a certain PCT condition, provided that data minimisation principle is respected and that the appropriate retention period for these data in employment relationships can be up to two years.

You can read the press release here and the guidance here, both only available in Slovenian.