- Enforcing jurisdiction
- Croatia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
A. T. – Court Ruling (Croatia, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A court ruled that the Croatian DPA must respond to a complaint about a hospital's failure to provide access to medical records. The court found that the DPA did not act within the required timeframe. This ruling underscores the importance of timely responses to data access requests.
What happened
The court ordered the Croatian DPA to issue a decision on a complaint regarding a hospital's failure to provide access to medical documentation.
Who was affected
A patient who filed a complaint with the Croatian DPA after not receiving access to her medical records.
What the authority found
The court determined that the DPA failed to resolve the case within the legally required 60 days, violating procedural rules.
Why this matters
This ruling highlights the obligation of data protection authorities to act promptly on complaints. It serves as a warning to DPA's about the importance of managing their caseload effectively.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 19 March 2026.
Processing notes: national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The case concerns a data subject who filed a complaint with the DPA alleging a violation of the GDPR by the controller (a hospital) according to [https://narodne-novine.nn.hr/clanci/sluzbeni/2018_05_42_805.html Article 34 of the Act on the Implementation of the GDPR (Zakon o provedbi Opće uredbe o zaštiti podataka - ZPOUZP)]. The data subject claimed the controller failed to provide access to her medical documentation and failed to inform her of its loss. The controller attributed the loss to irreversible server changes during a system overhaul in 2018/2019. The data subject filed the complaint with the DPA in November 2023, which included details of the alleged personal data breach and supporting evidence. The DPA initiated an investigation requesting an explanation from the controller, including why the data subject was not informed about the data loss as required under Article 34 GDPR. Despite the DPA's actions, including supervisory activities at the hospital, the DPA did not resolve the case within the 60-day deadline prescribed under [https://narodne-novine.nn.hr/clanci/sluzbeni/2009_04_47_1065.html Article 101(2) General Administrative Procedure Act (Zakon o općem upravnom postupku - ZUP)]. The delay was attributed to a high volume of cases and limited resources. The data subject then initiated an administrative inactivity complaint, and the Administrative Court in Rijeka ruled in her favor. The court ordered the DPA to issue a decision on the case within 60 days under [https://narodne-novine.nn.hr/clanci/sluzbeni/2010_02_20_483.html Article 58(3) Act on Adminstrative Disputes (Zakon o upravnim sporovima - ZUS)] and awarded the plaintiff €2,500 for the costs of the legal proceedings under [https://narodne-novine.nn.hr/clanci/sluzbeni/2010_02_20_483.html Article 79(4) ZUS].
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for A. T. in HR
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. A. T. - Croatia (2024). Retrieved from cookiefines.eu
Last updated: