Zagrebački Holding d.o.o. – Court Ruling (Croatia, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Zagrebački Holding d.o.o. was found to have not properly informed users about how their identification documents would be used when they requested copies of their bills via email. This matters because it highlights the importance of clear communication about data collection practices. Companies must ensure users understand what information is needed and why.
What happened
Zagrebački Holding d.o.o. failed to adequately inform users about the legal basis for collecting identification documents when they requested their bills via email.
Who was affected
Users of Zagrebački Holding d.o.o. who requested copies of their bills via email were affected.
What the authority found
The Croatian DPA ruled that the company did not provide sufficient information about data collection and retention, violating multiple GDPR articles.
Why this matters
This case emphasizes the need for companies to clearly communicate their data handling practices. It serves as a reminder that transparency is crucial in building trust with users.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 15 August 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A utility and municipal services enterprise, Zagrebački Holding d.o.o. (the controller) provided users of its services with the option to request a copy of their bill via email. Where the name appearing in the email address differed from the user’s name, the controller requested a copy of an identification document as part of the process of verifying the identity of its users. It treated that discrepancy as an indication of possible identity fraud. According to the controller, users were asked to redact any information on the document that was not necessary for identification. In addition, the copies were deleted once the relevant purpose had been fulfilled and access to them was limited to a small number of authorised employees. The Croatian DPA (AZOP) found that the controller had not adequately informed users of the legal basis for collecting copies of identification documents, the applicable retention period, or whether providing such a copy was mandatory and what the consequences of not providing it would be. It held that the controller had infringed Article 13(1)(c) GDPR, Article 13(2)(a) GDPR and Article 13(2)(e) GDPR. Furthermore, it found that the company had not implemented appropriate technical and organizational measures for the process of verifying the identity of users who requested copies of bills via email, in violation of Article 25(2) GDPR. It fined the controller €25,000. The controller challenged the decision before the Administrative Court of Zagreb. It argued that it had published information on its website regarding the processing of personal data. It claimed that the information had been modelled on guidelines published by the EDPB. The controller further alleged that users had been informed that the data would not be retained for longer than was necessary for the purpose of the processing. It also argued that it did not collect an excessive amount of data, as it asked users to redact unnecessary information and that copies were deleted after
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Zagrebački Holding d.o.o. in HR
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Zagrebački Holding d.o.o. - Croatia (2026). Retrieved from cookiefines.eu
Last updated: