Enforcement · Croatian Data Protection Authority (azop) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Company: Insufficient legal basis for data processing

The Croatian DPA (AZOP) has imposed a fine of EUR 40,000 on a company that published personal data of sole traders on its website.

€40,000 Fine
Company
CROATIA
Art. 5 GDPR Art. 6 GDPR Art. 12 GDPR Art. 14 GDPR Art. 30 GDPR Art. 38 GDPR
Personal Data Supervisory Authorities Processing Telecommunications Processing Agreement
Mar 24, 2025 Source azop.hr

Full text

The Croatian DPA (AZOP) has imposed a fine of EUR 40,000 on a company that published personal data of sole traders on its website. The data originated from public sources and from the financial agency FINA. Although publicly accessible, the authority found that there was no valid legal basis for the publication. Furthermore, the company did not inform the data subjects about the processing of their data and did not properly document its processing activities. Another point of concern was that the data protection officer was also the managing director of the company, which constitutes a conflict of interest under the GDPR. Therefore, the company was fined for breaching Art. 5 (1) (a) and (e), Art. 6 (1) (f), Art. 12, Art. 14, Art. 30, and Art. 38 (3) and (6) GDPR.

Industry: Media, Telecoms and Broadcasting

How it connects

References

All 11

Related across sources

C-288/12 Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per The European Commission brought an infringement action against Hungary before the Court of Justice (Grand Chamber) under Article 258 TFEU, alleging that Hungary violated Article… CJEU Apr 8, 2014 Supervision Supervisory Authorities Personal Data
Guidelines 04/2021 Codes of Conduct as tools for transfers Guidelines on codes of conduct and monitoring bodies Guidelines ·EDPB Feb 22, 2022 International Transfer Processing Agreement Codes of Conduct
Guidelines 4/2018 accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679) Guidelines ·EDPB Dec 14, 2018 Certification Accountability Codes of Conduct
C-424/15 Xabier Ormaetxea Garai and Bernardo Lorenzo Almendros v Administración del Estado The CJEU ruled on a preliminary reference from the Spanish Tribunal Supremo concerning Xabier Ormaetxea Garai and Bernardo Lorenzo Almendros, who challenged their dismissal as… CJEU ·Second Chamber Oct 19, 2016 Supervision Supervisory Authorities Monitoring
Guidelines 3/2018 territorial scope of the GDPR (Article 3) Guidelines on the territorial scope of the GDPR Guidelines ·EDPB Nov 12, 2019 Territorial scope (GDPR) IP Address Processors
Opinion 10/2021 approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR competent SA of Hungary ·Opinion ·EDPB Mar 23, 2021 Codes of Conduct Supervision Supervisory Authorities
Related documents