EOS Matrix d.o.o. – €5,470,000 Fine (Croatia, 2023)

The DPA received an anonymous petition stating that EOS Matrix had unauthorized processing of a large number of personal data (of debtors). A USB stick containing 181,641 personal data of natural persons in the structure of first and last name, date of birth and OIB, who had outstanding debts to initial creditors that were purchased by EOS Matrix based on the cession agreement. Likewise, in the petition, it was stated that the database also includes 294 natural persons who were minors at the time. DPA has concluded: 1. The controller did not take appropriate technical measures to protect the processing of the personal data contained in the storage systems, which is contrary to Article 32 paragraph 1 point b) and paragraph 2 of the GDPR; 2. The controller processed the personal data of respondents who are not in a debtor-creditor relationship in their database without the existence of a legal basis from Article 6, paragraph 1 of the GDPR; 3. The controller processed special category (health data) in its database without the existence of a legal basis from Article 6, paragraph 1, and in connection with this, Article 9, paragraph 2 of the GDPR; 4. The data controller did not inform the data subjects in a transparent and prescribed manner about the processing of their health data in the privacy policies, which is contrary to Article 12 paragraph 1 of the GDPR and, in this regard, to Article 13 paragraphs 1 and 2; 5. For the recording of telephone conversations with data subjects in the period from May 25, 2018 to January 16, 2019, the data controller did not have an established legal basis from Article 6, paragraph 1 of the GDPR, and in this connection there was also a violation of Article 5, paragraph 2; 6. The controller did not inform the data subjects in an understandable and clear way about the processing of personal data in the form of recording telephone conversations, and thus acted contrary to Article 12, paragraph 1 of the GDPR. Regarding the point 1 it was