DPA case Decision 29-11-2021 – Dismissed (Croatia, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A complaint was dismissed by Croatia's data protection authority after a person claimed a company asked for her ID to update her personal data. The authority found that the company was following legal requirements to verify identity under anti-money laundering laws. This decision highlights the importance of companies collecting personal data when legally required.
What happened
A person complained that a company requested her ID card to update her personal data.
Who was affected
The individual who made the complaint regarding her personal data.
What the authority found
The authority ruled that the company was justified in collecting the ID card copy to comply with legal obligations.
Why this matters
This case shows that companies can collect personal data if required by law, emphasizing the need for compliance with regulations like anti-money laundering.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA received a complaint regarding a violation of the protection of personal data of X (the data subject). In this regard, the data subject stated that the company in question (the data controller) asked her for a copy of her personal document - identity card when updating her personal data in accordance with special regulations. As evidence of her allegations, the data subject submitted to the DPA the controller's response, information on the processing of personal data, and the email correspondence between the data subject and the data controller. In this specific case, the "Prevention of Money Laundering and Financing of Terrorism Act (Zakon o sprečavanju pranja novca i financiranja terorizma - ZSPNIFT)" applies, which prescribes measures, actions, and procedures that oblige entities and competent state bodies to prevent and detect money laundering and terrorist financing. Article 15 ZSPNIFT mandates customer due diligence, including identity verification via reliable sources, collecting data on the purpose and nature of business relationships, ongoing transaction monitoring to ensure consistency with the customer's profile and risk assessment, verifying the source of funds if needed, and maintaining up-to-date documentation. Furthermore, Article 79 ZSPNIFT requires that collected documentation include records used to verify the customer’s identity, such as copies of official personal documents or extracts from relevant registers. The data subject was contacted via letter and telephone to update his personal data and submit a copy of her ID card, as required by ZSPNIFT. The data controller provided the applicant with the choice of how to submit the ID card copy, as evidenced by a letter dated 16 July 2021. The data controller, justified the collection and processing of personal data, including the ID card copy, as necessary to fulfill its legal obligation to verify customer identity under the Act. The DPA held that the collection and processing of personal
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Decision 29-11-2021 in HR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Decision 29-11-2021 - Croatia (2021). Retrieved from cookiefines.eu
Last updated: