CROATIA DPA: Insufficient fulfilment of information obligations

The Croatian DPA (AZOP) has imposed seven fines totaling EUR 16,000 on data controllers for failing to adequately mark video-monitored areas. This lack of marking resulted in people entering these areas not being informed of the surveillance, as the signs were either not visible on entry or did not contain all the necessary information. The fines ranged from EUR 500 to 4,000 and were imposed on various establishments, including hotels, restaurants, and shops. According to Art. 27 (1) of the Law on the Implementation of the General Data Protection Regulation, it is the responsibility of data controllers to ensure that areas under video surveillance are clearly marked. These signs must be visible to individuals at the latest when entering the surveillance perimeter. Furthermore, according to Paragraph 2 of the same article, the signs must contain all relevant information as stipulated in Art. 13 GDPR.

This especially includes informing individuals that the area is under video surveillance, providing details about the data controller, and offering contact information through which individuals can exercise their data protection rights. GDPR Articles: Art. 27 Croatin Law on the Implementation of the GDPR, Art. 13 GDPR Industry: Not assigned