Company: Insufficient legal basis for data processing

The Croatian DPA (AZOP) has imposed a fine of EUR 40,000 on a company that published personal data of sole traders on its website. The data originated from public sources and from the financial agency FINA. Although publicly accessible, the authority found that there was no valid legal basis for the publication. Furthermore, the company did not inform the data subjects about the processing of their data and did not properly document its processing activities. Another point of concern was that the data protection officer was also the managing director of the company, which constitutes a conflict of interest under the GDPR. Therefore, the company was fined for breaching Art. 5 (1) (a) and (e), Art. 6 (1) (f), Art. 12, Art. 14, Art. 30, and Art. 38 (3) and (6) GDPR.

GDPR Articles: Art. 5 (1) a), e) GDPR, Art. 6 (1) f) GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 30 GDPR, Art. 38 (3), (6) GDPR
Industry: Media, Telecoms and Broadcasting