Cybersecurity Policy Report, Slovenian Information Commissioner Releases Opinion on Personal Data Transfers to U.S., (Jun 4, 2026)

By Tony Foley

The Slovenian information commissioner released an opinion yesterday on requirements regarding the transfer of personal data to third countries or international organizations under Chapter V of the European Union’s General Data Protection Regulation (GDPR).

The nonbinding opinion was offered pursuant to a request from a company seeking to establish several websites exclusively for the U.S. market. The company’s questions included whether its plan would constitute a data transfer under the GDPR, whether such transfers would require standard contractual clauses (SCCs), and whether a derogation under GDPR article 49 might be available, among others.

The information commissioner said in its opinion that processing constituted a transfer under GDPR Chapter V if the controller or processor (exporter) was subject to the GDPR for the specific processing, the exporter disclosed or made personal data available to an importer, and the importer was located in a third country or was an international organization. Noting that it did not have the authority to assess in advance the legal bases for data processing and transfers to a third country, the information commissioner’s opinion provides general explanations and legal bases based on its interpretation of the company’s questions.

With respect to legal bases for EU-U.S. data transfers, the opinion explains that the European Commission has adopted an adequacy decision for the U.S. that allows for the transfer of personal data to companies that participate in the Data Privacy Framework (DPF). If the importer company is on the DPF list, exporters may transfer personal data based on the DPF agreement. Other legal bases for transfers include adopting appropriate safeguards, like SCCs, or an article 49 derogation in specific cases.

The information commissioner emphasized that controllers must ensure compliance with all provisions of the GDPR and added that, because the company’s scenario involved a relationship between the controller and processor (including for web hosting, use of Google Analytics and displaying ads or sending newsletters), that relationship must be appropriately contractually regulated, meaning that the controller must have a legal basis for the transfer to a third country as well as an appropriate processing agreement with the processor, as required by GDPR article 28.

The opinion also addressed the issue of tracking cookies, explaining that under the Slovenian Electronic Communications Act, cookies or similar tracking technologies could be installed only if the user consented to the installation after receiving clear and comprehensive information about the circumstances of data processing.

Finally, the information commissioner said controllers must provide individuals with all information about the purposes of processing as required by GDPR article 13, including the information the controller intends to transfer to a third country and the presence or absence of an adequacy decision or a reference to appropriate safeguards adopted.

News: InternationalLegislation DataPrivacy GDPR