STA, 5 May 2022 - The Constitutional Court said on Thursday that collecting personal data when determining whether a person meets the recovered-vaccinated-tested rule based on a government decree and not a law was unconstitutional. The government thus violated article 38 of the Constitution. The relevant decrees remain in force but will be annulled after one year.
Information Commissioner Mojca Prelesnik warned in August 2021 that a relevant legal basis should be adopted to enable checking of Covid certificates in hospitality and event industries, and asked the Constitutional Court to review the government decree on this, as the government claimed that the legal basis for checking compliance with the recovered-vaccinated-tested rule was the communicable disease act and the EU legislation, in particular the General Data Protection Regulation (GDPR).
But the court dismissed this, noting that the GDPR was aimed at protecting individuals against inadmissible processing of personal data rather than allowing the state to process personal data.
The court said that the participation of individuals in social, political and religious life would depend on their consent to the processing of their personal information for the purpose of checking their compliance with the recovered-vaccinated-tested rule.
The government prescribed this with a decree, but the court decided that such a consent cannot be considered voluntary and thus also not a valid legal basis for interfering with the right to personal data protection.
Constitutional Court judges nodded to the information commissioner and clearly stated that any processing of personal data, even during an epidemic, when emergency measures are needed, is a breach of the constitutional human right to personal data protection, which is why a law is needed, the information commissioner said in response to the ruling.
"In Slovenia, it is prohibited to regulate data processing with government decrees, as they are not the result of a democratic decision-making process that can only take place in the National Assembly," the information commissioner added.
The government had more than enough time to adopt a relevant law that would allowed it to act legally, the commissioner said.
The disputed decrees remain in force, as their annulment would prevent the government from meeting its constitutional obligation of protecting people's lives and health, so the court decided the annulment will take affect after one year.
During this time, the government must make sure that a legal basis for the decree is passed, clearly stating which data may be collected and processed, the purpose for which they may be collected and processed, and how this is to be monitored.
