Enforcement · Croatian Data Protection Authority (azop) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Company: Insufficient legal basis for data processing

€80,000 Fine
Company
CROATIA
Art. 5 GDPR Art. 6 GDPR Art. 32 GDPR
Audit Logs Processing Agreement Monitoring Personal Data Privacy by Design & Default Healthcare Data Processor Processing
Mar 24, 2025 Source

How it connects

Related across sources

Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Case Law Data Protection Commissioner v Facebook Ireland and Maximillian Schrems CJEU

Full text

The Croatian DPA (AZOP) has imposed a fine of EUR 80,000 on a company. The company was responsible for monitoring parking lots at several supermarkets and a hospital. However, it accessed personal data – in particular license plate numbers and owner information – from the Croatian Ministry of the Interior's (MUP) vehicle registry without a valid legal basis. Access was gained via a web service that the company had secured the right to use in certain areas on the basis of a concession. However, the actual use went beyond the scope of this concession. In addition, a data processing agreement with the hospital was missing, the system was operated without appropriate technical and organizational protective measures, and there was no legal basis for processing the data. Thus, the company was fined for breaching Art. 5 (1) (b), Art. 6 (1), and Art.32 (2) and (4) GDPR.

Industry: Transportation and Energy

Original document at the source azop.hr

Similar Content