Sanction RGPD Croatian Data Protection Authority (azop) — Company : 80 k€ (2025)
- Autorité de contrôle
- Croatian Data Protection Authority (azop)
- Pays
- Croatie
- Entreprise / secteur
- Company
- Montant de l'amende
- 80 k€
- Date de la décision
- 24 mars 2025
- Fondement juridique
- Art. 5 (1) b), Art. 6 (1), Art. 32 (2), (4)
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Croatian DPA (AZOP) has imposed a fine of EUR 80,000 on a company. The company was responsible for monitoring parking lots at several supermarkets and a hospital. However, it accessed personal data – in particular license plate numbers and owner information – from the Croatian Ministry of the Interior's (MUP) vehicle registry without a valid legal basis. Access was gained via a web service that the company had secured the right to use in certain areas on the basis of a concession. However, the actual use went beyond the scope of this concession. In addition, a data processing agreement with the hospital was missing, the system was operated without appropriate technical and organizational protective measures, and there was no legal basis for processing the data. Thus, the company was fined for breaching Art. 5 (1) (b), Art. 6 (1), and Art.32 (2) and (4) GDPR.