# USR - Us I-755/2025-8

- Type: Case Law
- Source: Administrative Court in Rijeka
- Date: 2025-11-11
- Original: https://gdprhub.eu/index.php?title=USR_-_Us_I-755/2025-8
- Canonical: https://overview.legal/posts/49225
- Topics: Consent, Right to Erasure, Public Authority, Processing, Statistics, Personal Data, Right to be Forgotten, Security, Public Sector, Identification

## Summary

Facts — The data subject was a member of the management board of Zagrebački holding, a company owned by the City of Zagreb, from 3 September 2021 until 31 March 2023. A television broadcaster published several pieces, including a video on its YouTube channel, reporting on the data subject’s resignation. The publications mentioned his name, role, employer, salary, and information on the brand of his private car. The data subject filed a complaint with the Croatian Personal Data Protection Agency (AZOP), claiming that the publication constituted unlawful processing under the GDPR because the media lacked a valid legal basis under Article 6, the reporting was inaccurate and excessive, and it did not serve any genuine public interest. He latter further claimed during the lawsuit against AZOP's decision that the authority had incorrectly and incompletely established the facts, misapplied substantive law, and breached procedural rules. He emphasized that the published personal data was unrelated to transparency in public administration, that he was neither a public figure nor a political actor, and that any public interest ended once he left office on 31 March 2023. He invoked his right to erasure under Article 17 GDPR and sought removal of the content, annulment of AZOP’s decision, or alternatively, a remittal for a new procedure. AZOP contested the lawsuit in full, maintaining that it had acted in accordance with Article 34 of the Croatian GDPR Implementation Act and Article 77 GDPR. It argued that the publication fell within a justified public interest under Article 8 of the Croatian Media Act and that it had properly carried out a balancing test between privacy (Article 8 ECHR) and freedom of expression (Article 10 ECHR). According to AZOP, the reporting was necessary, proportionate, and not sensationalistic, and did not excessively intrude on the data subject’s privacy. It added that consent was not required because the processing relied on legitimate interest under Article 6(1)(f) GDPR. Holding — The Administrative Court dismissed the action and upheld AZOP’s decision. Because Zagrebački holding is a city-owned and publicly funded company, the court considered information about the data subject’s salary, compensation for using his private vehicle in official duties, and his managerial role to be directly connected to the use of public resources. This placed the publication within the legitimate public interest in transparency recognised by Article 8 of the Media Act. In its proportionality assessment, the court accepted AZOP's application of Article 5 and 6 GDPR, emphasizing that the published data did not touch upon the data subject’s family or intimate life but related solely to his public functions. Publication was therefore limited to what was necessary to inform the public about the management of a publicly owned company. The data subject’s claims that the publication was false or harmful to his reputation did not alter the outcome, as AZOP is not empowered to determine the truthfulness or tone of journalistic content, particularly under the journalistic exemption in Article 85 GDPR. Issues of accuracy or reputational harm must instead be pursued through media-law mechanisms such as requests for correction or civil actions. On the erasure request, the court held that the right to be forgotten under Article 17 GDPR cannot override freedom of expression and information where media reporting is involved. Although the data subject no longer served on the board, the publication continued to contribute to public understanding of how a major public entity was run during his tenure, thus the public interest persisted and erasure was not justified. Finally, the court reiterated that consent was not required because Article 6 GDPR offers alternative lawful bases for processing. Since Article 6(1)(f) was satisfied, the absence of consent was irrelevant. Concluding that AZOP had properly applied the law and that the interference with the data subject’s privacy was proportionate, the court upheld the decision and denied the data subject’s claim and costs.

## Full text

REPUBLIC OF CROATIAADMINISTRATIVE COURT IN RIJEKA[address] N 5Case number: Us I-755/2025-8IN THE REPUBLIC OF CROATIAJUDGMENTThe Administrative Court in Rijeka, presided over by Judge Ana Sabljak, with the participation of the recorder Petra Horvat Delimehić, in the administrative dispute of the plaintiff NV from [address], OIB: [personal identification number], represented by the authorized representative NVT, attorney at law at [address], against the defendant Agency for the Protection of Personal Data, Zagreb, Ulica grada Vukovara 54, OIB: 28454963989, for the purpose of establishing a violation of the right to the protection of personal data, 11 November 2025,judgment is The claim for annulment of the defendant's decision CLASS: UP/I-009-01/25-03/9, REGISTRATION NUMBER: 567-04-02/02-25-1 of 1 April 2025 is rejected.II. The plaintiff's request for reimbursement of the costs of the administrative dispute is rejected.Reasoning1. By the decision of the defendant CLASS: UP/I-009-01/25-03/9, REGISTRATION NUMBER: 567-04-02/02- 25-1 of 1 April 2025 (pp. 11-16 of the file), the plaintiff's request for determination of a violation of the right to protection of personal data was rejected as unfounded. The request in question (pages 17-29 of the file) refers to the personal data of the plaintiff published on the YouTube channel of Z1 Television on March 7, 2023 in a video titled "NVT, member of the Holding's management board, known for the "Tesla" affair, resigned!". The defendant justifies his decision by alleging that the Media Act constitutes the legal basis for the processing of personal data and that there is a legitimate public interest in the processing of personal data within the meaning of the provisions of Article 6 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, General Data Protection Regulation (hereinafter: the General Regulation).2. The plaintiff filed a claim with the Administrative Court in Zagreb as the court with subject-matter and territorial jurisdiction, and the case was decided on the basis of the decision of the Office of the President of the High Administrative Court of the Republic of Croatia No. 31 Su-369/2025-8 of 16 May 2025 was transferred to this court for further resolution as a less burdened court (Article 11 of the Courts Act, Official Gazette No. 28/13, 33/15, 82/15, 82/16, 67/18, 126/19, 130/20, 21/22, 60/22, 16/23, 155/23 and 36/24). 3. In the complaint and during the dispute, the plaintiff challenges the legality of the defendant's decision due to the erroneous and incomplete determination of the factual situation, the incorrect application of substantive law and the violation of the rules of administrative procedure. He explains that he filed a request with the defendant to establish a violation of the right to protection of personal data and to remove articles and videos published on several internet portals and platforms that contain his personal data, and published without legitimate purposes and legal bases in accordance with the General Data Protection Regulation (GDPR). The disputed posts, 45 in total, and the video in question, published on March 7, 2023, on the Z1 Television YouTube channel, at the link https://www.youtube.com/watch?v=aK7DlVnKvV8, under the title "NVT, member of the Holding's board, known for the "Tesla" affair, resigned!" relate to data about his private Tesla car, the amount of personal income and other personal data. He states that the publication in question, in addition to being untrue, does not serve the public interest because it does not contribute to the transparency of the work of public bodies, but rather intrudes on his private life and damages his reputation. He points out that he did not perform the duties of a public figure or was a member of a political party in order to possibly justify the public's interest in his personal data. Even if there was a public interest, since he was a member of the management board of Zagrebački holding d.o.o. from 3 September 2021 to 31 March 2023, such an interest no longer exists as of 1 April 2023. The controller did not take into account the purpose and scope of the personal data being published, so the plaintiff suffered damage in the form of a violation of his right to privacy and exposure to possible misuse of unauthorized published personal data. He points out that he did not give consent to the processing of his personal data and that the publication of the information violated Articles 5 and 6 of the General Regulation, as well as the provisions of the Act on media. It considers that there is no basis for the continued availability of the disputed content and that the condition for the application of Article 17 of the General Regulation (right to be forgotten) has been met. It proposes to the court to annul the disputed decision with the obligation to remove the disputed online content, or alternatively to return the case to the defendant for a new procedure.4. In its response to the complaint, the defendant disputes the complaint and the claim in its entirety and explains how it acted upon the plaintiff's request in accordance with Article 34 of the Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/18) and Article 77 of the General Regulation. In the proceedings, it was determined that this was the processing of personal data within the meaning of Article 4.2 of the General Regulation, but that the published information had a justified public interest within the meaning of Article 8 of the Media Act. It stresses the need to establish a balance between the right to protection of privacy (Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms, hereinafter: the Convention) and the right to freedom of expression (Article 10 of the Convention), which are equally protected fundamental rights, as well as that the legitimate interest derives from Art. 8 of the Media Act, which in the specific case he determined. The announcement in question was necessary and proportionate to the purpose of informing the public, and not sensationalistic or aimed at damaging the plaintiff's reputation. The defendant that for each right (from Articles 8 and 10 of the Convention) he conducted a proportionality test of legitimate interest in the sense of Art. 6. General regulations, evaluating the necessity and justification of the publication in relation to the public interest and the rights of the individual, and all relevant factors were considered: the nature of the data, the reasonable expectations of the subject, the effect on the person and additional protection measures. It was established that the processing was based on the legitimate interest of the public and in accordance with Articles 5 and 6 of the General Regulation. He points out that the consent referred to by the plaintiff is not necessary, but that the publication/processing of personal data could be considered legal if, among other things, such data processing is necessary for the legitimate interests of the data controller. In the specific case, it was not established that the publication was excessive encroached on the privacy of the plaintiff. The published content has public significance and informative value, and the plaintiff has not proven that there has been a violation of the right to the protection of personal data. It points to the relevant decisions of the European Court of Human Rights. It proposes that the court reject the claim.5. A hearing was held in the dispute and the parties, in accordance with the provisions of Article 6 of the Administrative Disputes Act (Official Gazette No. 36/24, hereinafter: ZUS), were given the opportunity to state their views on the requests and allegations of the other party and on all facts and legal issues that are the subject of this administrative dispute.6. The court conducted the evidentiary procedure by reviewing the video recording, reading the documentation contained in the file of this administrative dispute and the file of the administrative procedure that preceded this dispute and, in accordance with the provisions of Article 114, paragraph 3 of the ZUS, determined that the claim is unfounded. By a hearing decision dated 21 October 2025, the court rejected the plaintiff's evidentiary proposal for by his hearing, assessing the said evidence as superfluous for the resolution of this dispute since the circumstances on which it is proposed to hear the said can be established from the documents in the case file. It is indicated that, although the plaintiff was not heard in the sense of Art. 86 of the ZUS, the party was allowed to state its position on all factual and legal issues of the dispute at the hearing, which is evident from the content of the minutes (pp. 68-70 of the file).7. It is not disputed between the parties that the subject of the public publication on the YouTube channel of Z1 Television on 7 March 2023 is the personal data of the plaintiff in the scope of his name and surname, function, company in which he was employed, make of private car, information on the compensation for the use of a private car and salary.8. Since the personal data were published within the framework of media research, in this specific case, in addition to the General Regulation, the provisions of the Media Act (Official Gazette Nos. 59/04, 84/11, 81/13, 114/22.: hereinafter: Media Act).9. The provision of Art. 5. paragraph 1. of the General Regulation stipulates that personal data must be: (a) processed lawfully, fairly and transparently in relation to the data subject ("lawfulness, fairness and transparency"); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in accordance with Art. 89. paragraph 1. shall not be considered incompatible with the initial purposes ("purpose limitation"); (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation"); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data which are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ("accuracy"); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods if the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the implementation of appropriate technical and organisational measures to safeguard the rights and freedoms of data subjects ("storage limitation"); (f) processed in a manner which ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage by applying appropriate technical or organisational measures ("integrity and confidentiality"); 2 of the same article stipulates that the controller is responsible for compliance with paragraph 1 and must be able to demonstrate it ("reliability").10. According to the provision of Article 6(1) of the General Regulation, processing is lawful only if and to the extent that at least one of the following is met: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) the processing is necessary for compliance with a legal obligation to which the controller is subject; (d) the processing is necessary to protect the vital interests of the data subject or of another natural person; (e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.11.Art. 17 of the General Regulation stipulates the right of the data subject to obtain from the controller the erasure of personal data (right to be forgotten).12. According to Art. 2 of the Media Act, public information is information provided through the media.13. Art. 3 of the Media Act stipulates freedom of expression and freedom of the media, which includes, among other things, freedom of expression, independence of the media, freedom to collect, research, publish and disseminate information for the purpose of informing the public, and access to public information. Paragraph 3 of the same article stipulates that media freedom may be restricted only when and to the extent necessary in a democratic society in the interests of national security, territorial integrity or public order, the prevention of disorder or criminal offences, the protection of health and morals, the protection of the reputation or rights of others, the prevention of the disclosure of confidential information, or the preservation of the authority and impartiality of the judiciary only in the manner prescribed by law.14. Art. 7. The Media Act stipulates that every person has the right to protection of privacy, dignity, reputation and honour (paragraph 1), a person performing a public service or duty has the right to protection of privacy, except in cases related to the public service or duty that the person performs (paragraph 2), a person who, through his or her statements, behaviour and other acts relating to his or her personal or family life, attracts public attention cannot demand the same level of protection of privacy as other citizens (paragraph 3). 15. Art. 8 of the Media Act stipulates that there is no violation of the right to protection of privacy if, with regard to information, a justified public interest prevails over the protection of privacy in relation to the journalist's activity or to the information. 16. The Court finds, and this also follows from the allegations in the complaint, that from 3 September 2021 to 31 March 2023, the plaintiff performed the function of a member of the management board of the company Zagrebački holding d.o.o. In the specific case, the publication of information about the name and surname, function, and salary and compensation for the use of a personal vehicle of a member of the management board of the aforementioned company, precisely during the time when the plaintiff performed such a function (Article 7, paragraph 2 of the Media Act), represents a matter of public interest, since it is a company owned by the City of Zagreb and partially financed by public funds. The transparency of operations and compensation of management board members in such a company is a justified matter of public interest within the meaning of Article 8 of the Media Act. The right of the public to be informed about the use of public resources in this context prevails over the right to privacy, where the publication did not contain information from his family or intimate life, but exclusively information related to the performance of official duties (including the make of a personal car which, although privately owned, was used for official purposes).17. The Court concludes that the defendant correctly conducted the test of proportionality of legitimate interest and assessed that the publication was not excessive and that the processing of personal data can be considered lawful, justified and necessary within the meaning of Article 5 and 6 of the General Regulation, as extensively explained in the response to the complaint.18. In relation to the claims according to which the disputed video recording should be removed because, in the plaintiff's opinion, it contains untrue information and damages his reputation, the court points out that the defendant is not competent to determine the truthfulness of the published data (when they are published within the scope of the exception for processing for journalistic purposes under Article 85 of the General Regulation) or to assess whether they affect the plaintiff's reputation. The plaintiff had the opportunity to request a correction or publish his own statement on the said information, in accordance with Articles 40 and 56 of the Media Act. The court further notes that the plaintiff does not dispute the use of his own car for official purposes, but states that he had the approval of the Assembly of Zagreb Holding for this. The plaintiff's objection that the word "affair" was incorrectly stated in the description of the video and that it has a negative connotation does not affect the legality of the contested decision, since the truthfulness and character of the published information can be challenged by other legal means (such as a request for correction, publication of a correction, a claim for compensation for damages, etc.), and not through the personal data protection procedure. Therefore, in this case, the defendant correctly rejected the plaintiff's request for a determination of a violation of the right to the protection of personal data.19. The right to erasure of personal data (the right to be forgotten) to which the plaintiff refers is not absolute. The provision of Article 17, paragraph 3 of the General Regulation expressly stipulates that this right does not apply if the processing is necessary for the exercise of the right to freedom of expression and information. This court found, as explained above, that this is an exercise of the right to freedom of expression and information and, although the plaintiff no longer holds the position of a member of the management board, the publications in question still contribute to public insight into the circumstances of the management of a public company and therefore there is still a justified public interest in their availability, in accordance with the provision of Article 6. paragraph 1. t. (f) General Regulations and Art. 8 of the Media Act. Therefore, according to the opinion of this court, the conditions from Art. 17. General regulations for deletion of personal data. 20. As it was determined that the processing is necessary in terms of the provisions of Art. 6. paragraph 1. t. (f) of the General Regulations, it does not affect the legality of the absence of the consent provided for in the provision of Art. 6. paragraph 1. t. (a) since for the legality of the processing, as the provision itself prescribes, it is necessary that at least one of the prescribed conditions has been met, which is concrete (point f). 21. Consequently, since the contested decision was made in a properly conducted procedure based on a fully and correctly established factual situation and with the correct application of substantive law, the publication of the plaintiff's personal data in connection with his function as a member of the management board of the company Zagrebački holding d.o.o., for the purpose of media coverage, in the circumstances of the specific case, was not unlawful, nor, given the generally accepted standards of media coverage of an individual person, did it disproportionately violate the plaintiff's privacy, the defendant did not violate the law to the detriment of the plaintiff, so the contested decision should have been assessed as lawful.22. Therefore, based on the provision of Article 116, paragraph 1 of the ZUS, it was decided as in point I of the operative part of the judgment.23. The court decided on the costs of the administrative dispute by applying the provision of Article 147, paragraph 1 of the ZUS, according to which the party that loses the dispute bears all the costs of the dispute in full, unless otherwise prescribed by law. As the plaintiff was unsuccessful in this administrative dispute, there is no legal basis to grant his request for reimbursement of the costs of the administrative dispute. Therefore, the court decided as in point II of the operative part of this judgment. In Rijeka, November 11, 2025. Judge Ana Sabljak INSTRUCTIONS ON LEGAL REMEDY: An appeal against this judgment may be filed with the High Administrative Court of the Republic of Croatia. The appeal shall be filed through this court in a sufficient number of copies for the court and all parties to the dispute, within 15 days from the date of delivery of the judgment (Article 131, paragraphs 1 and 2 of the ZUS). The appeal shall suspend the execution of the contested judgment (Article 126, paragraph 6 of the ZUS).

## Cited law provisions (18)

### GDPR — gdpr-art-6-par-1-en

Processing shall be lawful only if and to the extent that at least one of the following applies:

### GDPR — gdpr-art-6-par-1-pnt-f-en

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

### GDPR — gdpr-art-89-par-1-en

Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

### GDPR — gdpr-art-2-en

Material scope

### GDPR — gdpr-art-3-en

Territorial scope

### GDPR — gdpr-art-4-en

For the purposes of this Regulation:

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-6-en

Lawfulness of processing

### GDPR — gdpr-art-7-en

Conditions for consent

### GDPR — gdpr-art-8-en

Conditions applicable to child's consent in relation to information society services

### GDPR — gdpr-art-10-en

Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

### GDPR — gdpr-art-11-en

Processing which does not require identification

### GDPR — gdpr-art-17-en

Right to erasure (‘right to be forgotten’)

### GDPR — gdpr-art-34-en

Communication of a personal data breach to the data subject

### GDPR — gdpr-art-77-en

Right to lodge a complaint with a supervisory authority

### GDPR — gdpr-art-85-en

Processing and freedom of expression and information

### GDPR — gdpr-art-86-en

Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation.

### GDPR — gdpr-art-89-en

Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

---
Generated by overview.legal · https://overview.legal/posts/49225 · 2026-08-22