Croatia

Company

40,000 €

GDPR enforcement action by Croatian Data Protection Authority (azop) on 2025-03-24.

Rank · Sector

#234

of 369 in Media, Telecoms and Broadcasting

Rank · Croatia

#17

of 43

Rank · All fines

#837

of 3,050

Case details

Authority: Croatian Data Protection Authority (azop)
Date: 2025-03-24
Controller / Processor: Company
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) a), e) GDPR, Art. 6 (1) f) GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 30 GDPR, Art. 38 (3), (6) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Croatian DPA (AZOP) has imposed a fine of EUR 40,000 on a company that published personal data of sole traders on its website. The data originated from public sources and from the financial agency FINA. Although publicly accessible, the authority found that there was no valid legal basis for the publication. Furthermore, the company did not inform the data subjects about the processing of their data and did not properly document its processing activities. Another point of concern was that the data protection officer was also the managing director of the company, which constitutes a conflict of interest under the GDPR. Therefore, the company was fined for breaching Art. 5 (1) (a) and (e), Art. 6 (1) (f), Art. 12, Art. 14, Art. 30, and Art. 38 (3) and (6) GDPR.

Open original source Links to the regulator's original publication or another source.