US Zagreb - Us I-4772/2023-10
Croatian court upholds DPA's €25,000 fine against Zagrebački Holding for GDPR violations.
The Administrative Court of Zagreb upheld a €25,000 fine imposed by the Croatian DPA on Zagrebački Holding. The company was penalized for failing to transparently inform users about the processing of ID copies and for using an inadequate identity verification procedure when sending bills via email. The DPA found violations of GDPR Articles 13(1)(c), 13(2)(a), 13(2)(e), and 25(2).
AI summary of the linked source. Not reviewed by an editor. How this works
Run Zagrebački Holding?
Get an email when a new story names Zagrebački Holding, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonZagrebački Holding violated GDPR by failing to clearly inform users how their ID copies were being processed and by using an inadequate identity verification method when delivering bills via email. These failures breached core GDPR transparency obligations (Articles 13(1)(c) and 13(2)(a/e)) and the data protection by design and by default principle (Article 25(2)). The case highlights that organizations must not only collect data lawfully but must also communicate processing activities clearly and implement proportionate, fit-for-purpose verification mechanisms. Regulators are increasingly scrutinizing everyday operational processes — such as billing and customer onboarding — not just large-scale data breaches. A €25,000 fine and adverse court ruling serve as a reminder that procedural GDPR compliance is enforceable and costly to ignore.