HEP Proizvodnja d.o.o. – Court Ruling (Croatia, 2026)

The data subject was employed by HEP Proizvodnja d.o.o., an electricity and heat generation provider (the controller), at one of its hydroelectric plants. Their work involved the maintenance of computer systems. Their employment was later terminated in April 2022. While the data subject was on sick leave, one of the computers located in their office stopped functioning. The data subject claimed that, because of this malfunction, they came to the workplace, disconnected and rearranged some equipment, and then left. According to the data subject, their office contained both work-related and private computer equipment, including devices and hard drives on which their personal data and the personal data of third parties were stored. The controller stated that the engineering workstation located in the office used by the data subject had lost its uninterrupted power supply due to equipment failure. It was necessary to turn it on and log in so that business processes could continue uninterrupted. The controller further claimed that the data subject appeared at the workplace despite warnings from their superiors that their presence was not needed, entered their workspace, attempted to tamper with the equipment and prevented other colleagues from accessing the computer data. The controller launched an internal investigation for the security incident. The controller stated that the processing of the data subject’s data was carried out by its Corporate Security Office and was necessary to maintain operational continuity and security of the facility. The data subject filed a complaint with the Croatian DPA. They claimed that, during the investigation, the controller unlawfully accessed and processed their personal data, including data stored on several computers and hard drives. They argued that some of the data stored there were private, that special categories of personal data were processed, and that the controller could tell from the names of certain files, before opening them, that they contained personal data. The controller argued that the equipment had been accessed because of a security incident affecting an engineering workstation forming part of the hydroelectric plant’s system. It claimed that the workstation was company property and that the data subject had, without authorisation, installed and removed hardware and changed passwords. The controller also alleged that the data subject had stored and sent a work project through a public network, which created a security risk. In addition, it alleged that files of a pornographic and erotic nature were found on a disk connected to the workstation during the technical and security review. The DPA rejected the complaint. It considered that the processing could not be assessed separately from the reason why the equipment had been removed. The equipment had been taken for an internal investigation into possible misconduct following a security incident in the workplace. According to the DPA, any personal data found on the equipment were accessed incidentally, since the controller could not know in advance whether the devices contained the data subject’s personal data, how much data they contained, or what categories of data were involved. The DPA also referred to Recital 20 in the context of the controller’s use of the data for evidence in legal proceedings. It found no violation of the data subject’s rights, noting that the controller had not forwarded the data to third parties or misused them. The DPA stated that the amount and categories of personal data, as well as the alleged involvement of more than one controller, were irrelevant in this case. The data subject challenged the DPA’s decision before the Administrative Court of Rijeka. The data subject argued that they had the right to access their personal data and that the controller could not deny this right based solely on an assumption about what they intended to do with the personal data once received. They also stated that the DPA had misapplied Recital 20, as there was no conflict of jurisdiction involved. They also alleged that, since more than one entity had been involved in the processing, the DPA should have examined whether the relationship between them had to be regulated under Article 26 or Article 28 GDPR. Additionally, the data subject considered that Article 9(2)(b) GDPR had been misinterpreted, as the conditions specified therein could not be met since, under Article 9(1) GDPR, the processing of special categories of personal data is prohibited. Moreover, the data subject claimed that Article 9(2)(f) GDPR did not provide a basis for an internal investigation, because an employer could not process data based on an assumption that it might be needed for legal defence. The Court noted that the controller’s actions were not aimed at processing the data subject’s personal data, but at resolving a technical malfunction. It emphasised that the computer and hard drives were located in the controller’s business premises and were connected to a workstation used by the data subject. Accordingly, it pointed out that there was no reason to assume in advance that the devices would contain the data subject’s personal data. The Court held that the processing was carried out in order to prevent damage to the controller’s computers and electronic communication systems, in accordance with Recital 49. The Court further held that the proportionality test was satisfied. The processing was limited to data contained in equipment located in the data subject’s workplace and relevant to the production process and the security incident. The Court also took into account that pornographic, erotic and entertainment files were found on a hard drive connected to the workstation. It considered that such content could reasonably be viewed as posing a risk to the functioning of the controller’s systems. The Court held that the processing was lawful under Article 6(1)(f) GDPR, since it was necessary for the controller’s legitimate interest in ensuring the functioning of the hydroelectric plant. Additionally, the Court referred to Article 6(1)(c) GDPR, considering the controller’s legal obligations regarding the security and operation of energy infrastructure in the Republic of Croatia. The court further held that the internal investigation was necessary for the exercise or defence of legal claims and in accordance with the controller’s public-interest duties to protect the network and infrastructure. Therefore, it ruled that the controller could rely on Article 9(2)(f) GDPR regarding the processing of special categories of personal data. The Court also rejected the data subject’s argument that several controllers or processors were involved. It accepted that the Corporate Security Office was an internal division within the controller’s corporate group and had conducted the investigation on behalf of the controller. Therefore, there was no need for a separate arrangement between controllers under Article 26 GDPR. The Court noted that a controller is generally required to provide a data subject with access to their personal data so that the data subject can be aware of the processing and verify its lawfulness, pursuant to Article 15 GDPR. However, it agreed that the request had to be assessed in light of the controller’s rights and obligations to protect its information and business systems. The court held that the granting of access to the data subject would jeopardize its legitimate interests. The Court dismissed the data subject’s appeal and upheld the DPA’s decision.