Enforcement · Croatian Data Protection Authority (azop) EN LLM context

Debt collection company: Insufficient legal basis for data processing

The Croatian DPA (AZOP) has imposed of fine of EUR 5,470,000 to a debt collection company.

€5,470,000 Fine

Debt collection company

CROATIA

Art. 5 GDPR Art. 6 GDPR Art. 12 GDPR Art. 13 GDPR Art. 32 GDPR

Personal Data Legitimate Interest Controllers Processing Security

Oct 5, 2023 Source azop.hr

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The Croatian DPA (AZOP) has imposed of fine of EUR 5,470,000 to a debt collection company. The investigation was triggered by an anonymous complaint stating that controller unlawfully processed personal data, with USB stick attached to the complaint containing personal data of 181,641 individuals. As a controller, the debt-collection company unlawfully processed sensitive data (health related) of their debtors, as well as the data of individuals who are not in a debtor-creditor relationship, most often collecting telephone number, first and last name and residential address. It was determined that the data controller did not adequately implement sufficient technical protection measures that could timely detected leakage of data from their system. Although there was a security system, the DPA determined that due to deficiencies the company lost control over the movement of their data subjects´ personal data.

Controllers Personal Data Processing

Furthermore, the company recorded comments related to the debtor´s state of health that the DPA found to be excessive processing without an adequate legal basis. Additionally, the DPA determined that the data controller has unlawfully recorded telephone conversations with data subject as the legitimate interest test assessment that established a legal basis for processing has not been conducted prior to the start of such processing. Finally, the DPA found that the data subjects have not been transparently informed on the processing of their data. GDPR Articles: Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 (1) GDPR, Art. 32 (1) b) GDPR Industry: Finance, Insurance and Consulting

Legitimate Interest Controllers Personal Data applies Art. 5(2)Art. 6(1)Art. 12(1)Art. 13(1)

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 10

Related across sources

C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Supervision

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data

C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) Jan 12, 2023 Supervisory Authorities IP Address Supervision

C-604/22 IAB Europe v Gegevensbeschermingsautoriteit In Case C-604/22, the Court of Justice of the European Union ruled on a preliminary reference from the Brussels Court of Appeal in proceedings between IAB Europe and the Belgian… Fourth Chamber Mar 7, 2024 IP Address Controllers Personal Data

C-136/17 GC and Others v CNIL C-136/17 (GC and Others) Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data

C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) Oct 6, 2015 Privacy Shield Supervision IP Address