Agencija za zaštitu osobnih podataka (AZOP) – Court Ruling (Croatia, 2026)

INA, a petrol station chain in Croatia, appealed, AZOP's, the DPA's, €5000 fine. The fine was based on AZOP's decision that INA, as a controller, did not take all necessary measures to prevent unauthorised access and visibility of the real-time CCTV feeds to all customers. INA disputed this decision, claiming legitimate grounds for such data processing, stressing that projecting real-time CCTV feeds in petrol station shops to customers is an accepted and normal practice in the industry and by the consumers themselves. The Court upheld the DPA's decision regardless, on two crucial grounds: the lack of compliance with the cumulative requirements to fulfil Art 6 GDPR and Art 32 (1 and 2) GDPR. Firstly, the Court sided with the DPA, stating INA, did not meet two of the three cumulative conditions, in depicting a legitimate interest for the purpose of ensuring a timely response by employees and deterring perpetrators of criminal and infringing acts. Therefore, the Court accepted the reasoning that, the requirement of necessity is not met, as the timely reaction by employees and a rapid response in the event of a harmful incident, can be achieved even without customers having real-time access to the video surveillance system. As Art 6(1)(f) prescribes that three conditions must be met cumulatively for the data controller to be able to demonstrate its legitimate interest for a lawful basis, the prescribed conditions are not cumulatively met. Secondly, the Court highlights that the screen's placement in the premises of the retail shop of the petrol station itself, with clear visibility for all, is contrary to Art 32(1) and (2) GDPR. The Court stresses INA failed to take necessary protection measures in accordance with existing and foreseeable risks of unauthorized disclosure of personal data. This becomes especially relevant, as the the controller allows customers, as unauthorised persons, access to the live feed in real time, exposing the personal data to risks such as copying, recording, or other unauthorised use of the video surveillance footage, or the sharing of such footage with third parties in any way.