Cybersecurity Policy Report, Slovenian Information Commissioner Issues Opinion on ID Card Processing, (Mar 17, 2026)
By Tony Foley
Slovenia’s Information Commissioner has responded to a request from a construction company with a non-binding opinion regarding the use of identification cards for access to a construction site by its employees.
The March 16 opinion emphasizes that an employer may process an employee’s personal data only if there is a legal basis for doing so or if it is necessary for the exercise of rights or obligations arising from or in connection with the employment relationship. In addition, an appropriate legal basis is required to identify workers who are in an employment relationship and workers who are sent to an employer by a contractual partner.
In this specific case, the opinion said that in principle, a photo of an employee on an ID card is optional unless a specific work area or process requires the identification of employees to ensure the safe and reliable performance of work tasks. If photos are used to process biometric personal data, specific provisions of the European Union’s General Data Protection Regulation (GDPR) and Slovenian implementing laws must be observed, including the registration of biometric measures with the commissioner and the implementation of processing only after receipt of approval.
The opinion outlines the requirements for establishing a legal basis for processing based on legitimate interests under GDPR 6(1)(f), noting that a controller must conduct a preliminary balancing test to assess whether the conditions for using legitimate interests as a legal basis is appropriate. In general, the following three cumulative conditions must be met for the legitimate interests basis to be lawful:
The controller’s interest must be legitimate (i.e., justified, acceptable and based on law) and clearly expressed;
The processing must be necessary to achieve the legitimate interest pursued by the controller (as when there is no other measure that would achieve the same objective with a lesser impact on the right to data protection); and
The interests or fundamental rights and freedoms of the individual must not override the interest of the controller.
The opinion discusses the factors to consider in conducting the balancing test, including principles of transparency and proportionality. Controllers are responsible for assessing the processing and determining the legal basis for it.
News: InternationalLegislation DataPrivacy DataSecurity GDPR