[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkiSpPBWy4XYeBAIJr-tf-t4ZsFmVCINclvA_8JqOPI0":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"e175e805-4656-484d-bfe0-0e53c2b173de","US Zagreb - Us I-4772\u002F2023-10","us-zagreb-us-i-4772-2023-10-ef8bbf","Created page with \"{{COURTdecisionBOX |Jurisdiction=Croatia |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=US Zagreb |Court_Original_Name=Upravni sud u Zagrebu |Court_English_Name=Administrative Court of Zagreb |Court_With_Country=US Zagreb (Croatia) |Case_Number_Name=Us I-4772\u002F2023-10 |ECLI= |Original_Source_Name_1=Tražilica odluka sudova RH |Original_Source_Link_1=https:\u002F\u002Fodluke.sudovi.hr\u002FDocument\u002FView?id=427a7b59-ed6a-489a-8c5a-ce49721d09bc&q=Op%c4%87a+uredba+o+za%...\" Show changes","The Administrative Court of Zagreb upheld a €25,000 fine imposed by the Croatian DPA on Zagrebački Holding. The company was penalized for failing to transparently inform users about the processing of ID copies and for using an inadequate identity verification procedure when sending bills via email. The DPA found violations of GDPR Articles 13(1)(c), 13(2)(a), 13(2)(e), and 25(2).","Croatian court upholds DPA's €25,000 fine against Zagrebački Holding for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=US_Zagreb_-_Us_I-4772\u002F2023-10&diff=52693&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-08-14T09:01:44+00:00","2026-08-14T10:00:14.220955+00:00",7,[17,20],{"name":18,"type":19},"Zagrebački Holding","vendor",{"name":21,"type":22},"GDPR","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":21,"slug":26},null,"gdpr",[28,30,35,40],{"category":29},{"id":23,"icon":25,"name":21,"slug":26},{"category":31},{"id":32,"icon":25,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":37,"icon":25,"name":38,"slug":39},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":65},"croatian-dpa-fines-zagrebaki-holding-25000-for-gdpr-transparency-and-identity-verification-failures","Croatian DPA Fines Zagrebački Holding €25,000 for GDPR Transparency and Identity Verification Failures","Zagrebački Holding violated GDPR by failing to clearly inform users how their ID copies were being processed and by using an inadequate identity verification method when delivering bills via email. These failures breached core GDPR transparency obligations (Articles 13(1)(c) and 13(2)(a\u002Fe)) and the data protection by design and by default principle (Article 25(2)). The case highlights that organizations must not only collect data lawfully but must also communicate processing activities clearly and implement proportionate, fit-for-purpose verification mechanisms. Regulators are increasingly scrutinizing everyday operational processes — such as billing and customer onboarding — not just large-scale data breaches. A €25,000 fine and adverse court ruling serve as a reminder that procedural GDPR compliance is enforceable and costly to ignore.",[55,56,57,58,59,60,61,62,63,64],"GDPR Article 13(1)(c) — information on purposes and legal basis of processing","GDPR Article 13(2)(a) — retention period information","GDPR Article 13(2)(e) — right to lodge a complaint with a supervisory authority","GDPR Article 25(2) — Data Protection by Default","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 PT-5 (Privacy Notice)","NIST Privacy Framework PR.PO-P1 (Policies and procedures for data processing transparency)","CIS Control 3 — Data Protection","ISO\u002FIEC 29100:2011 — Privacy Framework (Principle 6: Openness, Transparency and Notice)","ITIL — Service Design: Information Security and Compliance Management",{}]