On April 22, 2024, the Personal Data Protection Agency (AZOP) published a summary of its decisions in which it issued fines totaling €16,000 on seven unnamed entities for violations of the General Data Protection Regulation (GDPR) and the Law on the Implementation of the GDPR 2018 (the Law).

Background to the decision

AZOP stated that it issued seven administrative fines on hotels, catering establishments, and retail for unlawful video surveillance.  

Findings of AZOP

AZOP found that none of the seven entities notified the objects under video surveillance, i.e., the notice was not visible when entering the recording perimeter, and/or the notice did not contain all relevant information.

Specifically, AZOP stated, among other things, that Article 27(1) of the Law requires controllers to mark objects or individual rooms and the external surface of the object under video surveillance, and the notice must be visible when entering the recording perimeter at a minimum. Article 27(2) of the Law states that the notification must contain information in accordance with Article 13 of the GDPR with a simple and easy-to-understand image along with the text providing the following information:

• that the space is under video surveillance;
• information about the data controller; and
• contact information through which the respondent can exercise their rights.

Outcomes

In light of the above, AZOP issued fines totaling €16,000 on the seven unnamed entities. 

You can read the summary of the decision, only available in Croatian, here.