Court case Us I-451/2025-10 – Court Ruling (Croatia, 2026)

In 2022, a Croatian media outlet published articles about a person (data subject) who was, at the time, a member of the management board of Zagrebački holding d.o.o, a City of Zagreb-owned holding company providing municipal and utility services. The articles disclosed their name, the company where they were employed, their position, gross salary, the model of their personal vehicle, the gross monthly allowance for using a private vehicle, and the amount of a fine imposed by the Croatian Commission for the Resolution of Conflicts of Interest. The data subject held the management board position from September 2021 to March 2023. The data subject lodged a complaint with the Croatian DPA, alleging that the publication infringed their right to the protection of personal data and requesting the removal of the articles. The DPA rejected the complaint and found no violation. It concluded that the published personal data were appropriate, relevant and necessary for informing the public, due to the data subject’s position at the time of publication and because the public interest prevailed. The DPA also found that the public interest in the continued availability of the articles outweighed the data subject’s request for erasure under Article 17 GDPR. It pointed out that Article 17(3)(a) GDPR stipulates that the right to erasure does not apply to the extent that the processing is necessary for the exercise of the right to freedom of expression and information. The DPA considered the Croatian Media Act, noting that it applied as a special law. The Act regulates conditions for media freedom, the rights of journalists and access to public information. The DPA determined that according to Article 8 of the Media Act, there was no violation of the right to privacy if a legitimate public interest prevailed over the protection of privacy in relation to journalistic activities. The data subject contested the DPA’s decision before the Administrative Court of Zagreb. They argued that they were not a public figure, that they no longer held any public position after 1 April 2023, and that the continued availability of the articles damaged their reputation and met the conditions for erasure under Article 17 GDPR. The media outlet stated that all published information about the data subject was obtained from publicly available sources, as they were subject to proceedings by the Commission for the Resolution of Conflicts of Interest and had also been published by the city-owned company. The media outlet argued that the case involved information of significant public interest due to the fact that they concerned an investigation that revealed misconduct of a person in a public position, who was in fact fined for that reason. They further stated that the Croatian Constitution and the Media Act granted the media the right to freely report on such information. Regarding the initial publication, the court held that the Croatian Media Act served as a legal basis for the processing of personal data under Article 6 GDPR. It found that since the data subject had performed a public duty as a member of the management board of a city-owned company, the public interest in being informed prevailed over the protection of their personal data. The media outlet therefore had the right to publish information containing personal data to the extent that the data were relevant and necessary to achieve the purpose established by law. Regarding the removal of the articles, the court held that the DPA had correctly found that there was still a relevant legal basis for the continued processing of the data under Article 6(1)(f) GDPR. It confirmed that the public interest continued to prevail, thereby justifying the continued availability of the data subject’s personal data in the articles for the purpose of public disclosure by the media. It further upheld that the conditions for erasure under Article 17 GDPR were not met, in light of the Article 17(3)(a) GDPR exception for the exercise of freedom of expression and information. The court dismissed the appeal and upheld the DPA’s decision. It also awarded €1,250 in costs to the media outlet.