DPA case Decision 16-02-2023 – Complaint Upheld (Croatia, 2023)

The DPA received a complaint regarding a violation of the protection of personal data of X (the data subject). The data subject states that the representative of the coowners of an apartment building in which he lives, made publicly available on a notice board the Decision on linking the land register and the register of concluded contracts for building X, which, among other things, contains his personal data. Upon receiving such a complaint, the AZOP launched a formal investigation. In the entire procedure conducted in this administrative matter, it was established that the representative of the co-owners of the residential building posted a Decision on the notice board, which included personal data of the applicant, such as name, surname, and land register details related to property ownership. The decision was made available to anyone, including non-residents, violating privacy by publicly sharing personal data. The DPA found multiple breaches of GDPR. The DPA held that the publication of coowners' personal data on a notice board violates their privacy under the GDPR, as it lacked a legal basis under Articles 5 and 6. The coowners' representative should have used alternative methods, such as meetings or mailed notices, to inform co-owners without publicly disclosing personal data.