DPA case AZOP 9 May 2024 (bank) – Violation Found (Croatia, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Croatian authority upheld a complaint against a bank for processing a former customer's personal information without a valid reason after their contract ended. This is significant because it shows that companies must stop using personal data once the relationship ends.
What happened
The bank was found to have processed a former customer's name and email address without justification after their contract had ended.
Who was affected
A former customer of the bank whose personal data was improperly processed.
What the authority found
The authority determined that the bank violated data protection rules by continuing to process the customer's data without a lawful basis.
Why this matters
This case reinforces that businesses must have a valid reason to use personal data, especially after a customer relationship has ended. Companies should review their data retention practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 9 May 2024 the Croatian AZOP upheld a complaint against an anonymised bank for processing a former customer’s name and email address after their contract had ended without a justified purpose or lawful basis. It found infringements of GDPR Articles 5(1)(b) and 6(1). Because the processing had already ceased, it imposed no additional corrective measure and no monetary fine.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case AZOP 9 May 2024 (bank) in HR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case AZOP 9 May 2024 (bank) - Croatia (2024). Retrieved from cookiefines.eu
Last updated: