Cybersecurity Policy Report, Slovenian Official Issues Opinions on AI Use in Health Care, Employee Surveys, (Jun 15, 2026)
By Tony Foley
Recently released opinions from the Slovenian information commissioner provide guidance on the processing of personal data by an artificial intelligence (AI)-powered telephone assistant for incoming calls to health care institutions, as well as the potential disclosure of the identity of employees who previously responded to an anonymous survey.
AI in health care. The information commissioner’s opinion on the use of an AI telephone assistant by health care institutions, including public pharmacies, health clinics, and health centers, specifies that any processing of personal data associated with such a tool, including input into the tool, storage of data, and transmission of data, must comply with the European Union’s General Data Protection Regulation (GDPR) and implementing Slovenian data protection regulations. The commissioner noted that most commercially available AI tools were currently problematic in the context of ensuring the protection of individual’s rights under the GDPR.
The opinion says that because data concerning health is a special category of personal data under GDPR article 9, one of the exceptions set out in that article must be provided in addition to the legal basis set forth in GDPR article 6. In accordance with the principle of accountability, a controller using an AI telephone assistant must demonstrate such a basis for the processing and the use of appropriate mechanisms to ensure the protection of personal data. Finally, a controller must inform individuals of certain important aspects of processing, like the identity of the controller, the purpose of the processing, the data retention period, and the rights of the individual, as provided in GDPR article 13.
The opinion adds that in the circumstances at issue, a data protection impact assessment (DPIA) may need to be conducted, since the processing involves new technologies may be likely to result in a high risk to the rights and freedoms of individuals. The commissioner has developed a list of processing operations for which a DPIA is mandatory, which indicates that there is a high probability that at least the processing of personal data in the development of AI systems will require the preparation of a DPIA.
The commissioner also drew attention to obligations that organizations have under the recently enacted AI Act, noting that AI systems for assessing and classifying emergency calls from natural persons or for dispatching emergency services, including police, fire, and medical assistance, are classified as high-risk AI systems, triggering the AI Act’s requirements regarding maintenance of technical documentation, ensuring transparency and introducing human oversight.
Anonymous employee surveys. On Friday, the Information Commissioner issued an opinion in response to a scenario in which an employee filled out a survey questionnaire that was completely anonymous, only to have management later request access to the data on who filled out the survey, ostensibly in response to allegedly harassing opinions.
The commissioner’s opinion clarifies that all personal data processing must be carried out lawfully, transparently and fairly under GDPR article 5. In addition, individuals must be clearly and understandably informed of all relevant circumstances of the processing of personal data under GDPR articles 13-14, which includes information on whether data will be processed anonymously.
In cases where individuals are informed that a survey is anonymous, an employer must conduct the survey in a manner that was presented to the individual and does not allow for the identification of the individual. Accordingly, if the survey was conducted as explained to the individual (in other words, anonymously), subsequent identification should not be possible and any request from management to subsequently establish the identity of individuals would be unfeasible.
To the extent that it is possible to subsequently identify the persons who completed the survey, the opinion notes, a prerequisite for the subsequent processing is that the data was collected lawfully. The commissioner concluded that, if the data was collected in a manner contrary to the information provided to individuals, there would be doubt about the legality of the data collected and about the legality of any further processing. Individuals in this situation can alert management, as well as filing a report with the commissioner. The opinion includes a link to information on submitting a report.
News: InternationalLegislation DataPrivacy DataSecurity GDPR AINews