DPA case Decision 31-05-2022 – Complaint Upheld (Croatia, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Croatian data protection authority found that a former school lost a student's records during a move, which violated data protection rules. The school failed to keep the student's information secure. This case shows the importance of proper data management.
What happened
The school lost a student's records and could not provide requested documentation.
Who was affected
The former student who requested a certified copy of their diploma and exam results.
What the authority found
The authority ruled that the school violated data protection rules by not taking adequate measures to protect personal data.
Why this matters
This case stresses the importance of data security in educational institutions. Schools must implement strong procedures to safeguard student records.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject requested their former school (the controller) to provide them with a certified copy of their master diploma and passed master exam. Whilst obliged to maintain records of former students in its database, the controller informed that the data subject's specific file was missing and the request could not be fulfilled. Consequently, the data subject filed a complaint before the Croatian DPA claiming a breach of their right to personal data protection. While determining the factual situation of the case, the DPA found out that the controller had lost the documentation in 2019, when due to weather problems, the school had to evacuate to another building. First, the DPA recalled that data controllers are obliged, under Articles 25 and 32 GDPR, to provide appropriate technical and organisational measures in order to ensure the security of personal data processing as well as prevent accidental loss or destruction of the data. In the present case, it was determined that the controller lost the requested documents when renovating and relocating the equipment and furniture to another building. Therefore, the controller did not respect the principles of completeness and integrity of personal data processing. The DPA held that appropriate measures should have been adopted, such as separating files containing personal data from other documents. It added that, especially in the education sector, it is important to continuously maintain and update the security of personal data processing as well as ensure the safe disposal of any personal data which is no longer relevant. In conclusion, the DPA determined that the controller violated Articles 25 and 32 GDPR by not adopting appropriate measures to prevent the loss of documentation containing personal data of the data subject.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Decision 31-05-2022 in HR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Decision 31-05-2022 - Croatia (2022). Retrieved from cookiefines.eu
Last updated: