News · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

AZOP (Croatia) - Croatian Gambling Operator

Special Categories of Data Controllers Personal Data Consent Voluntary Own-Initiative Investigations
Oct 11, 2026 Source gdprhub.eu

Full text

Machine translation of the decision, via GDPRhub — not the official text.

The DPA fined a gambling operator €2.59 m for processing biometric data without valid consent and beyond the necessary scope, bundling multiple purposes into single consent, and providing incomplete and inconsistent processing information. English Summary. Facts. The DPA initiated an ex officio investigation against a gambling operator (controller) regarding the identification and registration of players (data subjects) visiting its casino. The controller verified data subjects' identities at its casino using physical identity cards. To expedite identification during subsequent visits, it also offered data subjects the option to use an RFID chip or fingerprint scanning . On the basis of the data subjects' consent, the controller collected fingerprint scans from 34,933 data subjects. Although the controller claimed to collect two fingerprints, the investigation established that it actually scanned four fingers (two per hand) for biometric identification of data subjects. The c

How it connects

Related across sources

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… Fifth Chamber May 4, 2023 Right to Restriction Controllers Personal Data
C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Fairness & Transparency
C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) Jan 12, 2023 Supervision IP Address Integrity and Confidentiality Principle
C-634/21 OQ v Land Hessen In Case C-634/21, the CJEU addressed a preliminary ruling from the Verwaltungsgericht Wiesbaden concerning OQ's challenge against Land Hessen's refusal to order SCHUFA Holding AG… First Chamber Dec 7, 2023 Profiling Automated Decision-Making Marketing
C-446/21 Maximilian Schrems v Meta Platforms Ireland Limited In a preliminary ruling arising from proceedings between Maximilian Schrems and Meta Platforms Ireland Limited, the Court of Justice of the European Union interpreted GDPR… Fourth Chamber Oct 4, 2024 Retention Period Personal Data IP Address
C-205/21 Criminal proceedings against V.S In Case C-205/21, the Court of Justice of the European Union (Fifth Chamber) issued a preliminary ruling responding to a request from the Spetsializiran nakazatelen sad… Fifth Chamber Jan 26, 2023 Personal Data Types of Special Categories of Personal Data Retention Period
Related documents