Court case Pn-1378/2023-18 – Court Ruling (Croatia, 2025)

On 16 July 2021, a data subject and a bank (the controller) concluded a Custody Agreement for Financial Instruments. Under this agreement, the bank had to open a custody account for the data subject, safeguard and settle financial instruments, report on account activity, collect income, and keep the data subject informed about the status and changes of the custody account. On the same day, the parties also concluded a Service Agreement, which defined the rights and obligations related to that service. Article 4 of this agreement required the bank to keep all client information confidential in accordance with applicable laws and prohibited disclosure to third parties without written consent or a legal basis. On 11 January 2023, the controller mistakenly sent the data subject’s monthly custodial account statement, which contained sensitive personal and financial data, to another client instead of the data subject. The controller requested that the unintended recipient delete the email and corrected the technical error. The data subject remained uncertain about the extent of the data disclosure. Subsequently, she initiated a lawsuit claiming that this incident caused stress, anxiety, discomfort, and a loss of trust in the controller, and requested compensation for non-material damages. The Court held that the controller violated the data subject’s right to privacy under Croatian law and that this violation constituted non-material damage. It also referred to the violation of GDPR, without pointing out any specific article. The Court awarded compensation on the basis of Croatian civil law, specifically the rules on protection of personality rights and non-material damages under the Croatian Obligations Act. The court explained that the right to privacy is a personal non-property right that gives an individual full authority over their private life, including the ability to exclude others from accessing, collecting, or disclosing personal data without consent. Because the controller, a bank entrusted with confidential financial information, sent the data subject’s account statement to another client without consent, the court found that the disclosure amounted to an unauthorized intrusion into the data subject’s privacy. The court then assessed whether monetary compensation was justified. It emphasised that the controller did not provide the misdirected email, which prevented verification of the exact content disclosed. Although the controller asserted that only a monthly custody account statement was sent and that the unintended recipient deleted the message, the court held that these claims did not eliminate uncertainty about what was actually shared or whether it was further disseminated. This uncertainty increased the seriousness of the violation because the data subject could not know the full scope of possible consequences. The court therefore accepted that the data subject experienced mental distress, fear, and ongoing concern about how their personal and financial data might have been used. The court rejected the controller’s argument that no harm occurred because the data subject remained a client. It noted that the data subject terminated one of the custody accounts after the incident, reflecting a change in trust, but that the continuation of some services did not negate the harm suffered. When determining the amount of compensation, the court considered the intensity and duration of the data subject’s anxiety, including discomfort arising from knowing that another person had access to their personal and financial information and fears of potential burglary or extortion. The court also highlighted that the controller is a financial institution, which carries a heightened duty of professionalism and diligence due to the sensitive nature of the data it processes. Considering these circumstances and the purpose of non-material damages, the court found that €3,500 constituted fair compensation.