Advokáti Chlipala s.r.o.

AICH Advokáti Chlipala is a founding member of INPLP and has been part of the network since its very beginning. We are proud to have contributed to an international community built around trusted cooperation and shared expertise in privacy and data protection. AICH Advokáti Chlipala is a Slovak law firm with a strong focus on privacy and personal data protection, IT and technology law, cybersecurity, artificial intelligence, intellectual property and software law. Since 2003, we have advised leading companies and organisations on complex legal and regulatory matters, combining in-depth knowledge of the Slovak legal environment with an understanding of technology and business. Our privacy and data protection practice covers GDPR compliance, data governance, technology and digital projects, cybersecurity and data-related aspects of AI, as well as cross-border matters requiring coordination across jurisdictions. Through INPLP, we are able to combine our Slovak expertise with trusted international cooperation in multi-jurisdictional privacy matters. Miroslav Chlipala has more than 23 years of experience in IP & IT law, privacy and personal data protection, cybersecurity, software law, innovation, modern technologies and AI. His work focuses particularly on the intersection of law, technology and business. Miroslav is a recognised speaker and lecturer on technology-related legal issues. He regularly speaks at professional conferences and events organised by institutions and organisations including the Slovak Bar Association, Forbes, ESET and PwC. He also serves as Chairman of the Programme Committee of a leading Slovak conference dedicated to IT law. He has lectured at the Faculty of Law of Comenius University in Bratislava and is a co-founder of legal studies at the Slovak University of Technology in Bratislava. He is the author and co-author of numerous articles and publications on IP, IT and technology law and has participated in international academic programmes at the Hague Academy of International Law, the University of Oslo, the University of Ljubljana and Jagiellonian University in Kraków.

Representatives

Miroslav Chlipala

partner

Contact

Publications

• When Anonymization Fails: Readable Data in a Published ContractA decision of the Office for Personal Data Protection of the Slovak Republic confirms that the anonymization of a document intended for publication must be technically effective, rather than merely visual. If personal data become readable after text is copied from a PDF document, the controller may be in breach of its obligation to ensure the ongoing confidentiality of personal data under Article 32(1) of the GDPR, even where contracts are subject to mandatory publication in the Central Register of Contracts.7 October 2026
• GDPR knows no exceptions: Neither cities nor giants are safe!The Office for Personal Data Protection of the Slovak Republic recently ruled in two cases that clearly show neither cities nor large companies are immune to the strict rules of the GDPR. From attendance records in public administration to handling customer requests, even seemingly routine procedures can reveal serious personal data protection violations.11 December 2025
• Unauthorized Processing of Personal Data in Connection with a Traffic AccidentThe Slovak Office for Personal Data Protection (hereinafter referred to as the “Office”) recently imposed a fine of EUR 7,500 on Company CC for repeated and serious violations of data protection rules under the GDPR. Company CC, which focuses on compensating traffic accident participants, unlawfully collected and processed personal data without a proper legal basis and subsequently contacted these individuals with service offers. This case underscores the importance of lawful and transparent processing of personal data.5 November 2024
• Violation of personal data protection by the City of Trnava as the Controller of personal dataIn a recent decision by the Office for Personal Data Protection, we witnessed a case of violation of the Personal Data Protection Act and GDPR. The breach of personal data protection concerned the Controller, who unlawfully disclosed personal data of 47 affected individuals, including the applicant, in a resolution of the City Council of Trnava (“Resolution”).13 February 2024
• Data Protection vs. Anti-Doping Measures - Advocate General Ćapeta PerspectiveThis case highlights the challenging balance between safeguarding data privacy and preserving the integrity of sport through anti-doping measures. In a world where the internet is the primary channel for information dissemination, adapting data protection regulations to meet evolving dynamics while upholding the preventive goals of anti-doping initiatives is a critical consideration. The outcome of this case is expected to set a significant precedent in this ongoing and crucial debate.10 January 2024
• Decision of the Slovak court regarding requested disclosure of personal dataIn today's society, the issue of fulfilling the characteristics of personal data is the subject of many disputes as well as legal discussions. What would not have fulfilled the definition of personal data 5 years ago is possible today, because technological advances are making it increasingly easier. For this reason, it is necessary to exercise a considerable degree of prudence when disclosing personal data. Supreme Court of the Slovak Republic pointed out that "personal data is not only the data by which the natural person is directly identified, but also the data relating to the identifiable person." and pointed out that appealed decision of District Court, based on which District Court did not comply with the request regarding disclosure of personal data, was right.26 August 2022
• The new Slovak Electronic Communication Act shall change opt-out regime to opt-in regime for cookiesThe use of cookies will therefore no longer be linked to the passivity of the users concerned (opt-out). Anyone who stores or obtains access to information stored in the user's endpoint equipment (cookies) will have to have the prior consent of the user concerned (opt-in), and the consent must comply with the requirements of the GDPR.20 January 2022
• Based on the appeal of the controller, the imposed fine for several GDPR violations has been increased almost 15 times!By filing an appeal against the first-instance decision, the controller worsened its situation when the supervisory body increased the amount of the financial sanction almost 15 times! The principle of prohibition of reformatio in peius (prohibition of tightening up of the previous decision) is one of the essential principles of criminal proceedings, but in administrative proceedings, the tightening up of the first instance administrative decision is allowed.19 July 2021
• Slovak country-wide COVID-19 testing from the perspective of personal data protectionSlovakia has recently witnessed a significant increase in the number of confirmed COVID-19 cases. The country exceeded the threshold of one thousand cases per day on Oct. 7. Only about a week later, tests revealed over 2.000 infected people per day.2 November 2020
• Protection of Personal Data vs. Citizen’s HealthAt the time of the fight against the corona virus pandemic, the need to establish an imaginary border between the protection of personal data on the one hand, and the need to protect the lives and health of citizens on the other is much more relevant than was previously the case.16 April 2020
• Slovak list of processing operations which are subject to the requirement for a data protection impact assessmentWhere a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (hereinafter “DPIA”).6 May 2019