While testing a new Praktik feature—generating tables and analytically processing larger volumes of legal documents—the Majerník & Miháliková law firm asked a simple but practical question: what happens when we process the entire dataset at once instead of reading dozens of decisions individually?

For the test, they selected decisions issued by the Office for Personal Data Protection of the Slovak Republic concerning fines imposed in 2025. The dataset comprised 237 decisions. Its scale alone suggests that a conventional approach would require several days of time-consuming administrative work.

In this case, however, the entire process took approximately four hours.

How the processing worked

The process was not based on reading individual decisions one by one, but on processing them as a whole. Based on the prompts provided, Praktik created clear tables from the documents that captured the most important parameters.

These included, in particular, the type of decision; the area concerned (such as the Central Register of Contracts, CCTV systems, or other GDPR infringements); whether a fine was imposed and its amount; and the type of entity that breached the obligation.

The result was not merely a set of data, but a structured overview that makes it possible to understand the Office’s decision-making practice quickly.

Structure of the decisions

Of the 237 decisions, 223 were first-instance decisions, 12 were decisions on administrative appeals, and 2 were second-instance decisions. This basic overview already shows that the analyzed dataset consisted predominantly of first-instance decisions, which is relevant when assessing the Office’s practice.

What lies at the heart of the decision-making practice

Cases involving inadequate anonymization of personal data in the Central Register of Contracts made up the largest portion of the decisions analyzed: 182 out of 237.

Decisions concerning CCTV systems (25 cases) and other GDPR infringements (30 cases) accounted for considerably smaller shares.

From a practical perspective, this means that the vast majority of the Office’s decisions relate to a relatively specific but recurring problem: the incorrect anonymization of data in published contracts.

Outcomes and amounts of fines

In most cases, the Office imposed a fine—207 decisions in total. A warning was issued in 24 cases, 4 fines were annulled, and the fine was modified in 2 cases.

The lowest fine was EUR 300, the highest EUR 50,000, and the average fine amounted to EUR 911.96.

In total, the Office imposed fines of EUR 194,300. Infringements related to the Central Register of Contracts accounted for the largest share (EUR 102,900), followed by other GDPR infringements (EUR 85,200) and CCTV systems (EUR 6,200).

Blog chart

Who most often breaches the obligations

The analysis showed that the entities in breach were primarily legal entities—municipalities, public institutions, and companies. There were 218 such entities, compared with only 19 natural persons.

This finding also confirms that the Office’s decision-making practice largely concerns the public sector and organizations that publish documents.

What the analysis shows

Almost three quarters of all decisions concern inadequate anonymization of personal data in contracts published in the Central Register of Contracts.

In practice, these are mainly situations where contracts are published as PDF files but personal data remains readable after the text is copied. Penalties in these cases are relatively low, averaging approximately EUR 570.

By contrast, penalties for other GDPR infringements—such as unlawful disclosure of data or failure to process a data subject’s request—are significantly more severe. The average fine in this category is almost EUR 3,900.

For CCTV systems, the Office generally favors a warning over a fine. A fine was imposed in only 5 of the 25 cases, with an average amount of approximately EUR 1,240.

Why this type of analysis matters

This case study does more than present specific figures. It demonstrates a way of working.

When dealing with a larger number of decisions, the objective is not merely for a lawyer to read them. It is to quickly understand how a public authority decides, which situations recur, and what risks they create for the client.

The ability to work with data as a whole—rather than with individual documents—is precisely what makes it possible to reach these answers much faster.