DPA case Decision 30-12-2021 – Dismissed (Croatia, 2021)

The controller in this case is an online newspaper which published an article regarding the spending of public funds within a European Union funded programme. In this article, the newspaper published a data subject’s name, last name, and the fee data subject earned for their work as part of the programme. The data subject claimed the newspaper did not have a legal basis to share their personal data, and filed a complaint with the Croatian DPA. The Croatian DPA rejected the complaint. It considered that, in principle, the newspaper has a legal basis that follows from Article 3(1) and 3(2) of the Croatian Media Act (Official Gazette 59/04, 84/15, 81/13) which protects freedom of expression of the media. According to this law, the newspaper has the right to inform the public about matters of public interest. In this case, the DPA found that information on the how public authorities spend public funds must be considered in the public interest. Moreover, the DPA held that the processing of personal data was not excessive, and limited to what was necessary. Hence, the DPA concluded that the newspaper had a legal basis under Article 6(1) GDPR to publish the data subject’s personal data, and did not violate Article 5(1)(a) GDPR.