ZVOP-2 (Slovenian Personal Data Protection Act)

ZVOP-2 does not replace the GDPR, which applies directly; it fills the national margin of discretion. It governs the status, powers and procedures of the Information Commissioner as supervisory authority, the conditions for data protection officers, inspection and administrative offense provisions, and specifics for the public sector. It also transposes the European directive on the processing of personal data by competent authorities for the purposes of preventing, investigating, detecting and prosecuting criminal offenses and executing criminal penalties.

The act regulates in detail matters the GDPR does not address expressly. The most prominent is video surveillance: general conditions and the duty to post an adequate notice, keeping records, special rules for monitoring access to official or business premises, for surveillance in multi-apartment buildings, and for surveillance inside work premises, which is permitted only exceptionally where strictly necessary for the safety of people or property or the protection of classified information and where the purpose cannot be achieved by milder means, with prior notice to employees. Surveillance in changing rooms, elevators and sanitary facilities is prohibited. The act also covers biometric measures, processing for direct marketing, the linking of public sector databases, and processing for archiving, research and statistical purposes.

In practice ZVOP-2 is therefore a direct design constraint when planning physical and technical protection: camera coverage, retention periods for recordings, a documented decision to introduce surveillance, notices, records of processing, and defined and logged access to footage. Non-compliance is not only a supervisory risk — unlawfully collected recordings may lose their usefulness in a labor or other proceeding, undermining the very purpose for which the surveillance was introduced.