Company – €80,000 Fine (Croatia, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Croatian company was fined EUR 80,000 for improperly accessing personal data from a vehicle registry. They monitored parking lots but went beyond their allowed use of the data, violating privacy rules. This case highlights the importance of having a valid legal basis for data access.
What happened
The company accessed personal data from the Croatian vehicle registry without a valid legal basis.
Who was affected
Individuals whose license plate numbers and owner information were accessed by the company.
What the authority found
The authority ruled that the company violated multiple GDPR articles by processing personal data without a valid legal basis.
Why this matters
This ruling emphasizes that companies must strictly adhere to the limits of their data access rights. It serves as a reminder for businesses to ensure they have proper agreements and protective measures in place when handling personal data.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The Croatian DPA (AZOP) has imposed a fine of EUR 80,000 on a company. The company was responsible for monitoring parking lots at several supermarkets and a hospital. However, it accessed personal data – in particular license plate numbers and owner information – from the Croatian Ministry of the Interior's (MUP) vehicle registry without a valid legal basis. Access was gained via a web service that the company had secured the right to use in certain areas on the basis of a concession. However, the actual use went beyond the scope of this concession. In addition, a data processing agreement with the hospital was missing, the system was operated without appropriate technical and organizational protective measures, and there was no legal basis for processing the data. Thus, the company was fined for breaching Art. 5 (1) (b), Art. 6 (1), and Art.32 (2) and (4) GDPR.
Related Enforcement Actions (3)
Other enforcement actions involving Company in HR
Fine
€80K
Details
Fine Date
24 March 2025
Authority
Agencija za zaštitu osobnih podataka
Fine Amount
€80,000
Enforcement Tracker ID
ETid-2603
About this data
Cite as: Cookie Fines. Company - Croatia (2025). Retrieved from cookiefines.eu
Last updated: