Export
US Zagreb - Us I-3380/2025-9
A court upheld a DPA decision finding that a controller violated Articles 12(1) and 15 GDPR by failing to maintain a functioning email address for access requests.
Full text
Machine translation of the decision, via GDPRhub — not the official text.
A court upheld a DPA decision finding that a controller violated Articles 12(1) and 15 GDPR by failing to maintain a functioning email address for access requests. English Summary. Facts. A fast-food franchise company operating Pizza Hut restaurants in Croatia (the controller), published a privacy policy on its website informing users that they could exercise their data protection rights either by email at a designated email address or by post to its registered office. On 12 May 2025, an individual (the data subject) sent an access request under Article 15 GDPR]] to the designated email address, seeking confirmation and information regarding all personal data processed about them. The data subject immediately received an automated error response indicating that the controller’s email address was not found or was unable to receive emails. On 16 May 2025, the data subject lodged a complaint with the Croatian Personal Data Protection Agency (the DPA), enclosing copies of the sent email an