DPA case Decision 29-06-2022 (bank) – Violation Found (Croatia, 2021)

A bank (the controller) organized prize games for its clients. Considering that it had a large number of clients who lived in urban areas where it is not uncommon for different people to have the same first and last name and at the same time have the same address, the controller considered it necessary to undoubtedly establish the identity of the participants. Thus, it collected and processed the winners' data, and published it on the website. The Croatian DPA launched an investigation after it found out that the controller published the personal identification numbers (OIB) and residence addresses of the winners of the prize game on its website. Acting ex officio, the Croatian DPA requested a statement from the controller on the legal basis for such publication. The DPA also inquired on the method of informing the participants on the processing of their personal data under Article 13 GDPR. In response, the bank argued that in order to participate in the prize draw, it was necessary to enter the name, surname, OIB, phone number or e-mail address. The above data was requested for identification purposes and thus was fulfilling the obligation of the bank to conduct the prize game in accordance with the Ordinance on the organization of prize games, which also includes notifying the winner about the award. The Croatian DPA established that, in this case, the conditions for fair and lawful processing of personal data from Articles 5 and 6 GDPR were not met. The controller did not prove the existence of a legal basis for the publication of personal data consisting of the OIB and residence addresses of the winners of a particular prize game. This also amounted to a violation of the lawful, fair and transparent processing of personal data, and especially the data minimisation principle. The Croatian DPA decided to reprimand the data controller.