DPA case Decision 12-12-2023 – Complaint Upheld (Croatia, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Croatian City Tourist Board was found to have published a photo of a minor without proper consent. This case is important because it emphasizes the need for organizations to respect privacy rights, especially for children.
What happened
The City Tourist Board published a photo of a minor from a public event without obtaining permission.
Who was affected
A minor child whose image was used in promotional materials without consent from her parents.
What the authority found
The Croatian DPA determined that the City Tourist Board violated GDPR by using the minor's photo without a lawful basis.
Why this matters
This ruling highlights the importance of obtaining consent before using images of individuals, particularly minors. Organizations should implement clear policies for handling personal data in promotional activities.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA has received a complaint for a determination of a violation of the protection of personal data of minor X (the data subject). The complaint was submitted by the mother of the data subject (the applicant), in which it essentially states that the City Tourist Board (the controller) organized a sports day in the square of the City and that the event itself was photographed, although there was no information regarding GDPR, photography, etc. After the event ended, a report about the event was published in various media outlets (for example, on the Facebook and Instagram pages of City), accompanied by photographs, and some of the photographs in question included the applicant's minor daughter. The applicant points out that the image was used for promotional purposes, as an advertisement, without her permission (and without the permission of the applicant's husband), and that the applicant saw the image in question on the Facebook and Instagram pages and the website of the City. The applicant reacted to the above and contacted the data controller as the organizer of the event, after which they removed the photos from the Facebook profile and website of the City. However, the photo in question was not removed from City's Instagram page. The controller later stated that it does not manage the Instagram profile and therefore does not influence its content. However, the DPA inspected the City’s Instagram profile and determined that the photograph was no longer present, indicating that it was subsequently deleted. Upon receiving such a complaint, the AZOP launched a formal investigation into the processing activities of the controller. The DPA found multiple breaches of GDPR. The DPA held that the controller had a lawful basis under the GDPR to publish photographs from a public event in a public square but violated Articles 5 and 6 of GDPR by publishing a separate photo of the applicant's minor daughter without a lawful basis or purpose. The DPA further held that t
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Decision 12-12-2023 in HR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Decision 12-12-2023 - Croatia (2023). Retrieved from cookiefines.eu
Last updated: