- Enforcing jurisdiction
- Croatia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case Decision 23-03-2023 – Dismissed (Croatia, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Croatian municipality office dismissed a user's request for access to intimate photos that were allegedly related to her. This case matters because it highlights the challenges individuals face when trying to exercise their rights under GDPR.
What happened
The municipality office refused to provide access to photos claimed by a user.
Who was affected
The individual who claimed the intimate photos were about her.
What the authority found
The Croatian DPA found that the municipality office did not unlawfully process the user's personal data.
Why this matters
This case illustrates the complexities of data access requests and the importance of clear communication from companies when handling such requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The office of a municipality of a city in Croatia received an anonymous letter containing intimate photos of a person. A data subject claimed that those photos were concerning her, thus made an access request under Article 15 GDPR to the office and also requested her personal data to be deleted under Article 17 GDPR. The data subject also claimed that such data constituted biometric data. The office, as a controller, responded stating that it did have knowledge about the events which might possibly be related to the data subject but that it was not possible for it to determine the identity of the person in the pictures. Hence the processor refused to comply with the data subject’s access request. Following this, the data subject filed a complaint with the Croatian DPA (AZOP) claiming that the controller violated her GDPR rights by not responding to her access request and she also stated that the controller further processed her personal data by making it available to various unauthorized persons as well as to the public through media articles. In its submissions to the AZOP, the controller clarified that it did not unlawfully transmit or use personal data of the applicant, pointing out that it has learned about events that may have been related to the applicant, but from the information provided it was not possible to determine with certainty the identity of the person and its connection with other contents that were provided to the controller. Further, the controller underlined that it took all necessary measures to prevent the possibility of misuse or any other illegal and unauthorized actions related to the deletion of personal data. In conclusion, the controller stated that, upon request of the State Attorney, it sent the disputed letter to the employees of the Police Department of the city, as authorized officials, which was declared to be a confiscated object. Further, it was submitted that the two news articles mentioned by the data subject do not contain
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Decision 23-03-2023 in HR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Decision 23-03-2023 - Croatia (2023). Retrieved from cookiefines.eu
Last updated: