Croatia

Bank

1,500,000 €

GDPR enforcement action by Croatian Data Protection Authority (azop) on 2025-12-18.

Rank · Sector

#23

of 322 in Finance, Insurance and Consulting

Rank · Croatia

of 43

Rank · All fines

#143

of 3,050

Case details

Authority: Croatian Data Protection Authority (azop)
Date: 2025-12-18
Controller / Processor: Bank
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art 12 GDPR, Art. 13 GDPR, Art. 25 (2) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Croatian DPA has imposed a fine of EUR 1,500,000 on a bank. The controller offers its customers mobile banking via an app developed by the controller. On Android and Huawei devices, the app collected data on every app installed on the device. This happened without sufficient legal basis and infringed the principle of data minimisation.

Open original source Links to the regulator's original publication or another source.