VPNs with servers in Slovenia

An operator must enable lawful interception at a point in its public network once it receives the part of the competent authority’s order naming the point and duration (art. 228(1)), and must keep a non-erasable record of each interception for thirty years (228(5)). Operators of international networks must also supply equipment for interception under the law governing the intelligence agency (228(6)). Whether a VPN operator is an operator under the Act is not established.

Article 268 of the Act forbids operators and internet access providers to restrict, delay or slow the traffic of specific services or applications, except for emergency measures in a state of danger, urgent measures to curb unsolicited communications, or a court decision. The first two must be proportionate, non-discriminatory, limited in time and no wider than necessary.

Article 297 of the Criminal Code (KZ-1) punishes publicly inciting or stirring up hatred, violence or intolerance on grounds including nationality, race, religion, ethnicity, sex, skin colour, sexual orientation or any other personal circumstance, when done in a way that may endanger or disturb public order, or with threats, abuse or insults. As promulgated in 2012 the penalty was up to two years, up to three if aggravated.

Where the act is published on a website, the responsible editor is punished too, unless users post in real time or without prior control. On 24 April 2018 the European Court of Human Rights found a violation of Article 8 where police obtained subscriber information tied to a dynamic IP address without a court order.

On 3 July 2014 the Constitutional Court (U-I-65/13) annulled articles 162 to 169 of the earlier Electronic Communications Act, which required data on publicly available telephone services to be kept for fourteen months and other traffic data, internet data included, for eight, and ordered operators to delete the retained data. It found blanket retention disproportionate, among other reasons because use of the data was not limited to serious crime.

On 15 February 2024 the European Court of Human Rights found a violation of Article 8 in a case where a conviction rested on traffic and location data obtained under the retention regime then in force. The order of the rows is the security score, and a server’s location is not a recommendation.