View source for AZOP (Croatia) - Decision 05-10-2023

=== Holding ===
DPA has concluded: 
1. The controller did not take appropriate technical measures to protect the processing of the personal data contained in the storage systems, which is contrary to Article 32 paragraph 1 point b) and paragraph 2 of the GDPR;
2. The controller processed the personal data of respondents who are not in a debtor-creditor relationship in their database without the existence of a legal basis from Article 6, paragraph 1 of the GDPR;
3. The controller processed special category (health data) in its database without the existence of a legal basis from Article 6, paragraph 1, and in connection with this, Article 9, paragraph 2 of the GDPR;
4. The data controller did not inform the data subjects in a transparent and prescribed manner about the processing of their health data in the privacy policies, which is contrary to Article 12 paragraph 1 of the GDPR and, in this regard, to Article 13 paragraphs 1 and 2;
5. For the recording of telephone conversations with data subjects in the period from May 25, 2018 to January 16, 2019, the data controller did not have an established legal basis from Article 6, paragraph 1 of the GDPR, and in this connection there was also a violation of Article 5, paragraph 2;
6. The controller did not inform the data subjects in an understandable and clear way about the processing of personal data in the form of recording telephone conversations, and thus acted contrary to Article 12, paragraph 1 of the GDPR.

Regarding the point 1 it was determined that the data controller did not implement sufficient TOM that could timely recognize in the processing system (the main database in which personal data of about 370,000 data subjects are processed) activities that deviate from the usual ones (e.g. increased number of retrievals data in the database, transfer of data outside the system, compromise of user access, etc.). Precisely because of deficiencies in the security system, the insecure processing of personal data on a large scale number of respondents, and the company lost control over the movement of data and could not explain the causes or methods of data exfiltration.

It was established that EOS Matrix also processed data of data subjects who are not debtors nor legal representative (most often telephone number and first and last name and residential address).

Regarding the processing of health data, it was established that EOS Matrix, after communication with respondents, actively recorded comments related to the debtor's state of health in the internal database. Particularly worrying is the situation where the health condition of the subjects was monitored down to the details of individual diagnoses, which included terminal illnesses, and which almost exposes privacy to the maximum level to persons who are authorized to access the application (database) used by EOS Matrix employees. The arguments of EOS Matrix was that data subject had provided such information. DPA stressed that this does not mean that the same can be actively entered into the database. As a result of the above, it cannot be considered that there is an exception for the processing of health data from Article 9, paragraph 2, point e) of the GDPR. Furthermore, the reference to the legal basis regarding the execution of the contract, as well as the legitimate interest (which was referred to by the company in question) cannot be a legal basis either, since the processing of health data is not necessary to achieve the intended purpose. If the goal is better collection towards the debtor and avoidance of communication due to the health condition, then the same purpose could be achieved by recording a general comment about the need to avoid contact for a certain period of time due to the personal condition of the debtor, without highlighting precise health data.

Also, and related to the processing of health data, it was determined that EOS Matrix defined that it does not and will not process health data. This method resulted in non-transparent processing of data.

Also, in the period from May 25, 2018 to January 16, 2019, the data of 49,850 data subjects were processed, i.e. telephone conversations were recorded without determining the legal basis. The test of legitimate interest was conducted on January 16, 2019. 

Furthermore, regarding the recording of telephone conversations, it was established that EOS Matrix since 2014 has been using the functionality of recording telephone conversations with debtors, but indicating that the conversation "may" be recorded. 

It has not been determined how exactly 181,641 personal data were exfiltrated, and considering that in this specific case it is a question of the possible commission of the criminal offense of unauthorized use of personal data and criminal offenses against computer systems, programs and data, and also under the jurisdiction of the Ministry of the Interior. The DPA actively cooperates with the Zagreb Police Department and the Zagreb Municipal State Attorney's Office, which conduct investigative activities.

As a result of the above, it was undoubtedly established that the personal data submitted to the DPA via USB stick were excluded from the database of EOS Matrix!