A. T. – Court Ruling (Croatia, 2024)

The case concerns a data subject who filed a complaint with the DPA alleging a violation of the GDPR by the controller (a hospital) according to [https://narodne-novine.nn.hr/clanci/sluzbeni/2018_05_42_805.html Article 34 of the Act on the Implementation of the GDPR (Zakon o provedbi Opće uredbe o zaštiti podataka - ZPOUZP)]. The data subject claimed the controller failed to provide access to her medical documentation and failed to inform her of its loss. The controller attributed the loss to irreversible server changes during a system overhaul in 2018/2019. The data subject filed the complaint with the DPA in November 2023, which included details of the alleged personal data breach and supporting evidence. The DPA initiated an investigation requesting an explanation from the controller, including why the data subject was not informed about the data loss as required under Article 34 GDPR. Despite the DPA's actions, including supervisory activities at the hospital, the DPA did not resolve the case within the 60-day deadline prescribed under [https://narodne-novine.nn.hr/clanci/sluzbeni/2009_04_47_1065.html Article 101(2) General Administrative Procedure Act (Zakon o općem upravnom postupku - ZUP)]. The delay was attributed to a high volume of cases and limited resources. The data subject then initiated an administrative inactivity complaint, and the Administrative Court in Rijeka ruled in her favor. The court ordered the DPA to issue a decision on the case within 60 days under [https://narodne-novine.nn.hr/clanci/sluzbeni/2010_02_20_483.html Article 58(3) Act on Adminstrative Disputes (Zakon o upravnim sporovima - ZUS)] and awarded the plaintiff €2,500 for the costs of the legal proceedings under [https://narodne-novine.nn.hr/clanci/sluzbeni/2010_02_20_483.html Article 79(4) ZUS].