JK Law

JK GROUP Ltd. is a legal and tax consulting company located in Slovenia, focused on south-east European countries. We are specializing in DIGITAL LAW that covers industries of internet, IT, ICT, ecommerce, telecommunications, blockchain, cryptocurrencies, privacy data, big data,... We provide legal and tax consulting for companies, and full legal custody (legal and tax custody) for entrepreneurs and companies. We know that a comprehensive overview and viable solutions are important in business and that partial and fragmented knowledge of individual fields is incompatible with quality. Every legal transaction has tax consequences and vice versa. So we decided to combine knowledge from the various legal and tax fields with which a modern company needs to be acquainted with ensuring a smoothly running and successful business operation. T: + 386 5 909 17 94, E: info@jkgroup.si, Web: http://www.jkgroup.si/ Boris Kozlevcar is the Managing Partner at LAW FIRM JK Group Ltd. (IT, internet, ICT, Blockchain, GDPR law), covering main business and legal consultancy under Slovenian and European law. Main areas of his expertise are business and information law. He has been a regular lecturer at seminars organized by the Finance Academy and at other professional conferences in his field of work for many years. He has also participated in the comments on the implementation of laws and regularly writes articles published in major business print and online newspapers. He is a member of the International Association CSA. His expertise is sought after by different enterprises from various industries; he has been involved in advising small to medium-sized faster-growing companies in Slovenia up to one of the biggest companies in the field of e-commerce in the EU. Majority of clients he has consulted to originates from internet, IT and telecommunication industries.

Representatives

Boris Kozlevcar

partner

Contact

Publications

• Food delivery companies Wolt and Glovo being ordered by information commissary to stop Labelling Their Delivery PersonnelThe IC found that the food delivery companies had no legal basis for printing the identity numbers on the outside of the delivery bags of their personnel, presumably to prevent traffic violations. Both companies were ordered to stop this practice which violates the provisions of Articles 5/1.(a) and 6/1. of the GDPR. One of the orders is not yet final.8 October 2024
• Constitutional Court: The Criteria for Access to Traffic Data Too LooseSlovenia’s Constitutional Court found the provisions of the Criminal Procedure Act (CPA) enabling the prosecution (police) to access and seize traffic data (data about the circumstances of a communication) to be disproportionate and therefore in violation of the constitutionally guaranteed freedom to communication privacy. The Court set a one-year period in which the Parliament is to amend the CPA accordingly.12 December 2023
• As the last EU state, Slovenia passed Personal Data Protection ActAs of 2023 data privacy in Slovenia will be governed by the newly passed Personal Data Protection Act (ZVOP-2), which aims to bring country’s data protection framework in line with the GDPR. Slovenia became the last EU member state to fully implement the GDPR into its legal system when ZVOP-2 came into effect on January 26, 2023.24 May 2023
• Slovenia’s DPA Finds Cloud Computing Provider a (Joint) Controller of Personal DataSlovenia’s Information Commissioner (IC) ordered a cloud computing provider (a public administration body) to enter into written arrangements with its clients, in accordance with the provisions of Article 26 of GDPR. In its view, the fact that the clients (controllers) had little or no influence on the technical measures for processing personal data means that the cloud provider should be considered a joint controller.23 December 2022
• Slovenia: Publication of an E-mail Address not a Waiver of the Right to PrivacyThe Constitutional Court of the Republic of Slovenia annulled the criminal conviction for the development, advertising, and selling of malicious computer code, which was based on the evidence gathered by the FBI without a court order after the perpetrator had published his email address in an online forum.11 August 2022
• Constitutional Court: No IP address to be Revealed Without a Court OrderThe Constitutional Court of the Republic of Slovenia annulled the criminal conviction for an online defamation, which was based on the IP address of the perpetrator acquired from the website operator, without a court order. The Supreme Court’s view that the violation of an individual’s right to communication privacy was less severe as it was not committed by the state, was rejected as flawed.17 December 2021
• Slovenian Information Commissioner authorises publication of data on Police staff salaries and other personal dataFollowing a strike announcement by two Police unions (over low pay, among other issues), the Ministry of Interior published on its website the names, surnames, gross pay levels and Covid 19 allowances for all Ministry staff, including those working for the Police (an independent agency within the Ministry). The Information Commissioner (IC) supported this move and reiterated their position that the publication of the personal data in question was in line with the Access to Public Information Act, which declares such data, if it relates to public servants, to be public information.22 June 2021
• The Unauthorised Access to Personal Data by the Slovenian PoliceOn July 10, 2020, a press conference was held in the hall of Slovenia’s legislative body by Jožef Horvat, MP, a member of one of the coalition parties which until early this year had spent many years in the opposition. The MP explained that his subject access request (SAR) filed with the Police in May produced evidence of 22 instances of access to his personal data, 13 of which contained no explanation as to the purpose thereof.20 August 2020
• GDPR through the prism of coronavirus epidemicThe difficulty of drawing a hard-and-fast line between the right to privacy and the rights of other people to stay healthy17 March 2020
• Slovenia’s DPA says mere possession of processing equipment does not amount to personal data processingSlovenian courts have in place a system for audio recording of court hearings. The data recorded (which in itself constitute personal data, as the recordings can be related to natural persons, such as the parties or their legal representatives, witnesses and expert witnesses) is stored on computer servers owned by the state and managed by the Ministry of Public Administration. The servers, however, are located on the premises of the Ministry of Justice, meaning that the latter’s employees have physical access to them.17 July 2019
• Supreme Court Finds the Publisher and the State Liable for Personal Data BreachIn August 2018, the Supreme Court of the Republic of Slovenia upheld the judgements of the lower courts finding the publisher and the state (Republic of Slovenia) jointly liable for the publication in a secondary school textbook of a set of data which allowed for the indirect identification of the plaintiff.10 December 2018
• Slovenia’s ICO defines DPO’s additional tasks that could result in a conflict of interestsParagraph 6, Article 38 of the General Data Protection Regulation (GDPR) allows the Data Protection Officer (DPO) to fulfil other tasks and duties (beside serving as the DPO) for the controller or processor, provided however, that fulfilling such additional assignments doesn’t amount to a conflict of interest.23 November 2018