On November 4, 2024, the European Data Protection Board (EDPB) published the decision of the Information Commissioner of Slovenia (the Commissioner) in case no. 0603-42/2023/12 of October 5, 2024, where it fined FOVELLA d.o.o., acting as the owner of DODO PIZZA franchise in Slovenia, €25,000, for monitoring of its employees in violation of the General Data Protection Regulation (GDPR).

Background to the decision

The EDPB outlined that the Commissioner carried out an investigation which revealed that FOVELLA unlawfully monitored employees in the restaurant's kitchen via CCTV and unlawfully broadcasted CCTV footage live on the company's website.

Findings of the Commissioner

The EDPB highlighted that the Commissioner found that monitoring of employees using CCTV inside working premises can only be carried out as an exception and when it is absolutely necessary for the safety of people or property. The Commissioner found that such monitoring was in violation of Article 78 of the Personal Data Protection Act.

Furthermore, the Commissioner held there was no legal basis under Article 6 of the GDPR for the broadcast by the controller of the CCTV footage of employees working in the kitchen live on the company's website.

Outcomes

In light of the above, the Commissioner imposed a fine of €25,000 on FOVELLA.

You can read the EDPB press release here and download the decision, only available in Slovenian, here.