- Enforcing jurisdiction
- Croatia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Company – €80,000 Fine (Croatia, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Another Croatian company was fined EUR 80,000 for improperly accessing personal data from a vehicle registry. The company used the data beyond its permitted scope and lacked proper agreements and security measures. This case underscores the importance of having a valid legal basis for data access.
What happened
The company accessed personal data from a vehicle registry without a valid legal basis.
Who was affected
Individuals whose license plate numbers and owner information were accessed by the company.
What the authority found
The authority ruled that the company breached several GDPR articles by accessing and processing personal data without proper justification.
Why this matters
This ruling highlights the need for companies to ensure they have valid legal grounds for accessing personal data. It serves as a warning for businesses to establish clear agreements and security measures when handling sensitive information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 10 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Croatian DPA (AZOP) has imposed a fine of EUR 80,000 on a company. The company was responsible for monitoring parking lots at several supermarkets and a hospital. However, it accessed personal data – in particular license plate numbers and owner information – from the Croatian Ministry of the Interior's (MUP) vehicle registry without a valid legal basis. Access was gained via a web service that the company had secured the right to use in certain areas on the basis of a concession. However, the actual use went beyond the scope of this concession. In addition, a data processing agreement with the hospital was missing, the system was operated without appropriate technical and organizational protective measures, and there was no legal basis for processing the data. Thus, the company was fined for breaching Art. 5 (1) (b), Art. 6 (1), and Art.32 (2) and (4) GDPR.
Related Enforcement Actions (2)
Other enforcement actions involving Company in HR
Fine
€80K
Details
Fine Date
24 March 2025
Authority
Agencija za zaštitu osobnih podataka
Fine Amount
€80,000
About this data
Cite as: Cookie Fines. Company - Croatia (2025). Retrieved from cookiefines.eu
Last updated: