Enforcement · Croatian Data Protection Authority (azop) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Insurance company: Insufficient fulfilment of information obligations

The DPA has ex officio, without prior notice, conducted a direct supervision over an insurance company based in Zagreb.

Insurance company
CROATIA
Art. 13 GDPR Art. 14 GDPR
Controllers Supervisory Authorities Supervision Insurance Monitoring
Jul 5, 2021 Source azop.hr

Full text

The DPA has ex officio, without prior notice, conducted a direct supervision over an insurance company based in Zagreb. Upon inspection of its business facility for carrying out technical inspections and vehicle registration and contracting insurance services, the DPA established that both the business facility and its external surface are under video surveillance. However, the DPA established that the insurance company has failed to provide notice of such surveillance, which is contrary to Art 27 (1) of the Law on the Implementation of GDPR. Namely, data controllers and processors are obliged to indicate that the object and its outer surface are under video surveillance, and such notice must be visible at the latest when entering the perimeter of the recording and must contain all the prescribed information. Due to the breach, the DPA imposed an administrative fine on the insurance company.

Industry: Finance, Insurance and Consulting

How it connects

References

Related across sources

Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
C-807/21 Deutsche Wohnen SE v Staatsanwaltschaft Berlin C-807/21 (Deutsche Wohnen) CJEU Dec 5, 2023 Fines Public Authority Processors
10 A 5144/23 VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the… Administrative Court Hannover Aug 7, 2026 Controllers Supervisory Authorities Legitimate Interest
Opinion 11/2019 draft list of the competent supervisory authority of the Czech Republic regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35(5) GDPR) Opinion ·EDPB Jul 12, 2019 DPIA Supervision Supervisory Authorities
Guidelines 8/2022 identifying a controller or processor's lead supervisory authority Guidelines for identifying a controller or processor’s lead supervisory authority Guidelines ·EDPB Apr 17, 2023 Supervision Controllers Supervisory Authorities
Opinion 15/2025 certification criteria of BDO Consulting GmbH Austrian SA (AT SA) ·Opinion ·EDPB Jul 14, 2025 Certification Supervision Supervisory Authorities
Related documents