Court case Us I-4570/2023-5 – Court Ruling (Croatia, 2026)

The DPA had found that the controller had infringed Article 27 ZPOUZP by using CCTV inside and outside its premises without displaying a video-surveillance notice at the latest upon entry into the recording perimeter. ZPOUZP is the Croatian Act on the Implementation of the GDPR. Article 27 of this Act specifically regulates processing of personal data via video surveillance.The contested decision had further found that the controller had failed to display all relevant information required under Article 27(2) ZPOUZP, namely information about the controller and contact details through which data subjects could exercise their rights. The DPA imposed a fine €3,500 to the controller. The controller appealed this decision before the Administrative Court of Zagreb. The controller contested the legality of the DPA’s decision and requested its annulment. It argued that, as the DPA itself had acknowledged, there were several notices informing data subjects of the existence of video surveillance in the area. Therefore, according to the controller, it was incorrect to conclude that the notices were not visible upon entry into the recording perimeter. Regarding the contact point through which data subjects could exercise their rights, the controller further argued that it had clearly and sufficiently indicated that another entity, acting as processor, had been entrusted with the processing of the relevant personal data on its behalf. It pointed out that the processor’s phone number and email address had been provided. The DPA argued that it had correctly applied the law to the facts of the case. It acknowledged that several CCTV notices existed, but emphasised that the indication that the building was under video surveillance had to be visible no later than upon entry into the recording perimeter. In the controller’s case, the DPA considered that the first video-surveillance notice had been placed in such a way that data subjects would already be within a camera’s field of view before having the opportunity to see it. The DPA further noted that the controller had infringed Article 13 GDPR by failing to provide complete and clear information about its identity. It stated that data subjects had to deduce the controller’s identity solely from the email address of an individual who, among other things, was no longer employed by the controller. The DPA also considered that, by providing the contact details of its processor instead of its own contact details, the controller had infringed Article 27(2) ZPOUZP. The court set aside the DPA’s conclusion on Article 27(1) ZPOUZP. It held that the DPA’s findings did not clearly establish that data subjects would be captured by a camera before having the opportunity to see the first video-surveillance notice. Therefore, the court held that the DPA’s inspection report and accompanying photographs did not provide a sufficient basis for concluding that Article 27(1) ZPOUZP had been infringed. Regarding Article 27(2) ZPOUZP, the court upheld the DPA’s finding, noting that the notice did not clearly and intelligibly identify the controller and instead listed the name and email address of a person who was no longer employed by the controller. The court annulled the DPA’s decision in its entirety, because the unlawfulness of one part of the decision affected the legality of the imposed fine. It ordered the DPA to issue a new decision in the case.