Enforcement · Croatian Data Protection Authority (azop) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Company: Insufficient legal basis for data processing

€40,000 Fine
Company
CROATIA
Art. 5 GDPR Art. 6 GDPR Art. 12 GDPR Art. 14 GDPR Art. 30 GDPR Art. 38 GDPR
Notified Body Responsibilities and Operational Obligations Personal Data Processing Agreement Processing Telecommunications Supervisory Authorities Scientific Panel Independence Notified Body Independence
Mar 24, 2025 Source

How it connects

Related across sources

News Data Protection Officer or Chief Privacy Officer?The rise of the Data Protection Officer White Label Consultancy News Het Italiaanse bedrijf SA heeft juridische stappen ondernomen tegen een gemeente vanwege het gebruik van haar videosurveillance systeem en omdat het haar Functionaris Gegevensbescherming (FG) heeft aangesteld om de gemeente in een rechtszaak te vertegenwoordigen. GDPRhub Guidance Guidelines 04/2021 on Codes of Conduct as tools for transfers EDPB Guidance Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB News Can the roles of DPO and whistleblowing officer be merged? IAPP Guidance Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679) EDPB

Full text

The Croatian DPA (AZOP) has imposed a fine of EUR 40,000 on a company that published personal data of sole traders on its website. The data originated from public sources and from the financial agency FINA. Although publicly accessible, the authority found that there was no valid legal basis for the publication. Furthermore, the company did not inform the data subjects about the processing of their data and did not properly document its processing activities. Another point of concern was that the data protection officer was also the managing director of the company, which constitutes a conflict of interest under the GDPR. Therefore, the company was fined for breaching Art. 5 (1) (a) and (e), Art. 6 (1) (f), Art. 12, Art. 14, Art. 30, and Art. 38 (3) and (6) GDPR.

Industry: Media, Telecoms and Broadcasting

Original document at the source azop.hr

Similar Content