Zagrebački Holding d.o.o. – Court Ruling (Croatia, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Croatian court ruled that Zagrebački Holding d.o.o. did not properly inform users about the collection of identification documents when they requested copies of their bills. This ruling is significant because it highlights the importance of clear communication regarding data collection. Companies should ensure they inform users about why they collect personal information and how it will be used.
What happened
The Croatian DPA found that Zagrebački Holding d.o.o. failed to adequately inform users about the legal basis for collecting identification documents.
Who was affected
Users who requested copies of their bills from Zagrebački Holding d.o.o. were affected by the lack of information.
What the authority found
The court decided that the company did not provide sufficient information about the identity verification process and the retention of documents.
Why this matters
This case underlines the necessity for companies to communicate clearly about data collection practices. Businesses should review their processes to ensure users are well-informed.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A utility and municipal services enterprise, Zagrebački Holding d.o.o. (the controller) provided users of its services with the option to request a copy of their bill via email. Where the name appearing in the email address differed from the user’s name, the controller requested a copy of an identification document as part of the process of verifying the identity of its users. It treated that discrepancy as an indication of possible identity fraud. According to the controller, users were asked to redact any information on the document that was not necessary for identification. In addition, the copies were deleted once the relevant purpose had been fulfilled and access to them was limited to a small number of authorised employees. The Croatian DPA (AZOP) found that the controller had not adequately informed users of the legal basis for collecting copies of identification documents, the applicable retention period, or whether providing such a copy was mandatory and what the consequences of not providing it would be. It held that the controller had infringed Article 13(1)(c) GDPR, Article 13(2)(a) GDPR and Article 13(2)(e) GDPR. Furthermore, it found that the company had not implemented appropriate technical and organizational measures for the process of verifying the identity of users who requested copies of bills via email, in violation of Article 25(2) GDPR. It fined the controller €25,000. The controller challenged the decision before the Administrative Court of Zagreb. It argued that it had published information on its website regarding the processing of personal data. It claimed that the information had been modelled on guidelines published by the EDPB. The controller further alleged that users had been informed that the data would not be retained for longer than was necessary for the purpose of the processing. It also argued that it did not collect an excessive amount of data, as it asked users to redact unnecessary information and that copies were deleted after
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Zagrebački Holding d.o.o. in HR
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Zagrebački Holding d.o.o. - Croatia (2026). Retrieved from cookiefines.eu
Last updated: