Court case Pn-877/2023-29 – Court Ruling (Croatia, 2026)

A data subject filed a lawsuit against Propuls d.o.o., the controller and publisher of the news portal direktno.hr, claiming that two articles published on 11 January 2023 and 31 January 2023 disclosed her personal data without her consent: The first article reported on payments related to the football club Dinamo Zagreb and included the data subject’s full name, bank account number, and payment amounts. The second article referred to the first article via a hyperlink but did not mention the data subject directly. The data subject argued that the disclosure violated her right to privacy and the protection of personal and family life under Croatian law and the GDPR. She claimed non-material damage and sought compensation as well as publication of the court decision in the controller's news portal. The controller admitted publishing the articles but argued that the information was accurate and that publishing the data served the public interest. The controller also stated that it had issued a correction upon the data subject request and argued that journalistic activity may be exempt from certain obligations under GDPR and it's exempt from liability if the facts concerned are true according to the Croatian Media Law. The evidence included the published articles, the correction request, witness testimony from journalists and the data subject, and financial records. The court held that the controller violated the data subject’s right to privacy and the protection of personal and family life. It reasoned that publishing her full name, bank account number, and payment amounts was disproportionate because the details were not necessary to inform the public about the football club payments. Following the ECHR jurisprudence, the court applied a proportionality test, balancing the controller’s freedom of expression against data subject's privacy rights under the Croatian Constitution and civil law. The court emphasised that the data subject was not a public figure, had no