The International Press Institute (IPI) and the Slovene Association of Journalists (DNS) today sent a letter to the Information Commissioner of the Republic of Slovenia in regard to the ongoing inspection procedure against IPI member investigative newsroom Oštro.
The inspection concerns the processing of personal data in the media outlet’s investigative and data journalism project, Asset Detector. Our organisations call on the Commissioner to review the process and discontinue this procedure, stressing that media should be able to carry out watchdog investigative reporting, including data-driven journalism, without facing unnecessary pressure.
The letter is published in full below.
Dr. Jelena Virant Burnik
Information Commissioner of the Republic of Slovenia
Dunajska cesta 22; SI-1000 Ljubljana
12 December 2025
Dear Dr. Jelena Virant Burnik,
We are writing to you on behalf of the International Press Institute (IPI), a global network of editors, media executives and leading journalists, and Slovene Association of Journalists (DNS) in regard to the ongoing inspection procedure against Oštro, Slovenia’s prominent investigative media organisation and a member of IPI.
Following communication with Oštro, it has come to our attention that the office of the Information Commissioner of the Republic of Slovenia recently opened a procedure against Oštro concerning the processing of personal data in the media outlet’s investigative and data journalism project, Asset Detector.
After carefully assessing its arguments and its potential impact on media freedom and investigative journalism in Slovenia, our organisation respectfully calls on you to review the process and discontinue this procedure.
Several GDPR articles were cited in the original request from the Information Commissioner as the legal basis, requesting from Oštro to provide information about its processing of personal data. These included Article 6 GDPR (lawfulness of processing), Articles 12–14 GDPR (informing data subjects), and Articles 15–22 GDPR (rights of data subjects, such as access, rectification, and erasure).
Any application of such GDPR provisions must be considered in the light of the nature of investigative journalism. Both Slovenian law and EU law recognize that journalists and media outlets are entitled to process personal data in the exercise of freedom of expression and for reporting on matters of public interest. The GDPR itself allows Member States to provide exemptions for journalistic purposes (Article 85), meaning that the obligations applicable to ordinary data controllers do not automatically apply to media organizations like Oštro.
Investigative and data journalism projects, such as the Asset Detector, that promote transparency and accountability, clearly serve the public interest and are vital for a functioning democracy. As noted by Oštro in its response to the Information Commissioner’s request, this form of data journalism, including the collection and analysis of datasets, is a common form of journalism in the digital age and is standard worldwide.
Especially noteworthy in this case is that Oštro anonymised the personal data of the named officials’ family members for publication, ensuring their privacy and the inability to connect the published data to individuals. The data was presented cumulatively as “family members’ assets” to avoid exposing them and disclosing them to the public. All published data was collected from public sources.
Oštro also has clearly defined reporting rules that are always accessible to the public. This includes a detailed description of how it obtains, verifies and updates data on its website. In all cases, including this one, the media outlet always directly contacts the public official concerned before publishing the data.
We further note that IPI also recently expressed our concern about the complaint the Ljutomer municipality recently submitted to the Specialised State Prosecutor’s Office regarding Oštro and have documented this complaint as a threat to media freedom in an alert published on our monitoring platform Mapping Media Freedom. An alert has also been published on the Council of Europe’s Platform for safety of journalists. IPI has also reached out to the Ljutomer municipality with a letter urging the authority to review their complaint.
We note finally that Oštro is a highly professional and respected media outlet which has a long track record of high-profile investigations, and collaboration on major global investigative projects. We therefore reiterate our call to discontinue the GDPR procedure against Oštro. Media outlets must be able to carry out watchdog investigative reporting, including data-driven journalism, without facing unnecessary pressure.
We remain open to further communication with you on this important matter.
Thank you for your consideration.
Sincerely,
International Press Institute (IPI)
Slovene Association of Journalists (DNS)
This statement by IPI is part of the Media Freedom Rapid Response (MFRR), a Europe-wide mechanism which tracks, monitors and responds to violations of press and media freedom in EU Member States, Candidate Countries, and Ukraine. The project is co-funded by the European Commission.
