AZOP (Croatia) - Decision 18-05-2023: Difference between revisions

Revision as of 14:24, 2 June 2023

AZOP - Decision of 18 May 2023 - sports betting company

Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 6(1) GDPR Article 13(1) GDPR Article 13(2) GDPR Article 25(1) GDPR Article 25(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	18.05.2023
Fine:	380000
Parties:	n/a
National Case Number/Name:	Decision of 18 May 2023 - sports betting company
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Croatian
Original Source:	AZOP (in HR)
Initial Contributor:	Presido_Croatia

The Croatian DPA imposed a fine of €380,000 on a sports betting agency for collecting and storing copies of both sides of data subjects' credit cards, in breach Articles 6(1), 13(1) and (2), and 25(1) and (2) GDPR.

English Summary

Facts

A sports betting agency, acting as the controller, offered players (the data subjects) the possibility to receive payments directly to their credit cards, instead of receiving a bank transfer. To do so, it required them to submit a copy of both sides of the credit card by email. A citizen brought the facts to the attention of the Croatian DPA, which initiated an ex officio investigation due to the high risk to the rights and freedoms of the data subjects.

Holding

At the end of the investigations, DPA found that there was no legal basis for the processing of both sides of the data subjects' credit card as this was not necessary for the fulfillment of the obligations foreseen in the Anti-Money Laundering Law. According to the DPA, an in-depth analysis of the players could be done through a means less invasive for their privacy of data subjects.

The DPA also found that the controller stored these data for a period longer than necessary and contrary to the provisions of its own privacy policy, which stated that financial data would not be stored. It also found that the controller's employees, in the period between June and December 2022, had access to complete information on more than 655 copies of a total of 2078 collected copies of credit cards. Thus, it held that sufficient techniques and organization were not implemented to protect the rights of data subjects.

In addition, the DPA pointed out that the controller failed to inform the data subjects about the legal basis for the processing, its purposes and the period of storage of the data, violating the principle of transparency. It highlighted that financial data is considered a special category of data and its processing entails a high risk. Despite this, data subjects were not aware of all the information regarding its processing.

As mitigating circumstances, the DPA considered that the controller cooperated with the investigations and committed to adjust its conduct to the GDPR and to adopt measures to reduce the risks of handling financial information. For example, it committed to investing in the security of payment processing so that it is no longer necessary to send both sides of the credit card. In addition, it stated that it would delete the stored data and to train and monitor its employees.

Still, a fine of €380,000 was imposed for the violation of the following GDPR Articles: 6(1); 13(1) and (2); 25(1) and (2).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

The Agency for the Protection of Personal Data imposed an administrative fine on the data controller - a trading company for organizing games of chance - betting games (sports betting) in the amount of EUR 380,000.00 due to the following violations of the General Data Protection Regulation:

The data controller processed personal data, i.e. copies of bank cards of the respondents, for which no legal basis was proven, which violated Article 6, paragraph 1 of the General Regulation on Data Protection;
The data controller did not adequately inform the respondents about the processing of personal data, i.e. about the processing of data contained on copies of bank cards, which violated Article 13, paragraphs 1 and 2 of the General Data Protection Regulation;
When creating a new business process for a quick payment service to a VISA bank card, the data controller did not implement appropriate technical and organizational measures, which violated Article 25, paragraph 1 and 2 of the General Data Protection Regulation;
The controller did not apply a technical encryption measure to the personal data of the respondents stored in the controller's databases and did not regularly assess the effectiveness of technical and organizational measures to ensure the security of the processing, which violated Article 32, paragraph 1, points a) and d) of the General Regulation on Protection data.
Namely, the Agency received a citizen's submission about the collection of a two-sided copy of the bank card via electronic mail by the processing manager in question. Pursuant to its powers, the Agency initiated the procedure ex officio due to the high risk to the rights and freedoms of the respondents (players, users of the service).

In the case in question, it was established that from June to December 2022, the processing manager provided the players with an additional service of paying out winners to a VISA card, in addition to the already existing possibilities of paying out funds from the user's account to a bank account. It was determined that the processing or collection of copies of bank cards is not necessary in order to comply with legal obligations arising from the Law on Prevention of Money Laundering, since the in-depth analysis of players can be carried out without collecting copies of both sides of bank cards. As a result of the above, the processing manager illegally processed copies of bank cards using inadequate means of processing and stored them without applying appropriate technical and organizational measures.

Also, the data controller did not inform the respondents about the processing in question (storage of copies of bank cards) in accordance with the principle of transparency, and thus the respondents were deprived of basic information about data processing such as the legal basis, purpose and storage period. Namely, in the Statement on personal data protection measures, which forms part of the Privacy Policy, it was expressly stated that the data controller does not store bank card numbers and that the numbers are not accessible to unauthorized persons.

However, employees of the processing manager in the period June - December 2022 had access to 655 copies of bank cards on which the full extent of data was visible out of a total of 2078 copies of bank cards collected. Such processing resulted in a high-risk violation of a third of the total processed data, and the respondents were not even aware that this data was stored in databases.

Given that financial data is considered a sensitive category of personal data, which depending on the context and scope of processing can cause a high risk for the rights and freedoms of the data subject, the controller was obliged to pay special attention to the security and legality of the processing, which was taken taken into account as an aggravating circumstance.

As a mitigating circumstance in the specific procedure, the degree of responsibility shown by the data controller after the supervision was carried out - on his own initiative, he informed the Agency about the way in which he plans to harmonize the processing with the provisions of the General Data Protection Regulation. Thus, the processing manager made additional investments in payment processes in such a way that the system was improved and that the delivery of a copy of the bank card is no longer requested, and that all stored copies of the bank cards were deleted. Also, the processing manager stated that he improved the business processes of monitoring the processing of personal data and educated employees.

@@ Line 38: / Line 38: @@
 |GDPR_Article_5=Article 25(2) GDPR
 |GDPR_Article_Link_5=Article 25 GDPR#2
-|GDPR_Article_6=Article 32(1) GDPR
-|GDPR_Article_Link_6=Article 32 GDPR#1
-|GDPR_Article_7=Article 32(2) GDPR
-|GDPR_Article_Link_7=Article 32 GDPR#2
-|GDPR_Article_8=
-|GDPR_Article_Link_8=
-|GDPR_Article_9=
-|GDPR_Article_Link_9=
 |EU_Law_Name_1=
@@ Line 71: / Line 64: @@
 }}
-Following an investigation after data subject's complaint (regarding the collection of copies of bank cards), the DPA imposed a fine of EUR 380,000 for GDPR violations for sports betting company.
+The Croatian DPA imposed a fine of €380,000 on a sports betting agency for collecting and storing copies of both sides of data subjects' credit cards, in breach [[Article 6 GDPR#1|Articles 6(1)]], [[Article 13 GDPR|13(1)]] and [[Article 13 GDPR|(2)]], and [[Article 25 GDPR|25(1)]] and [[Article 25 GDPR#2|(2) GDPR]].
 == English Summary ==
 === Facts ===
-DPA received a complaint about the collection of a two-sided copy of the bank card via electronic mail by the controller in question. Pursuant to its powers, the DPA initiated the procedure ex officio due to the high risk to the rights and freedoms of the respondents (players, users of the service).
+A sports betting agency, acting as the controller, offered players (the data subjects) the possibility to receive payments directly to their credit cards, instead of receiving a bank transfer. To do so, it required them to submit a copy of both sides of the credit card by email. A citizen brought the facts to the attention of the Croatian DPA, which initiated an ex officio investigation due to the high risk to the rights and freedoms of the data subjects.
-In the case in question, it was determined that from June to December 2022, the data controller provided players with the additional service of paying out winners to a VISA card, and in addition to the already existing possibilities of paying out funds from the user's account to a bank account.
 === Holding ===
-The Croatian DPA imposed an administrative fine on the data controller - s company for sports betting in the amount of EUR 380,000.00 due to the following violations of the General Data Protection Regulation:
+At the end of the investigations, DPA found that there was no legal basis for the processing of both sides of the data subjects' credit card as this was not necessary for the fulfillment of the obligations foreseen in the Anti-Money Laundering Law. According to the DPA, an in-depth analysis of the players could be done through a means less invasive for their privacy of data subjects.
-The data controller processed personal data, i.e. copies of bank cards of the data subjects, for which no legal basis was proven, which violated Article 6, paragraph 1 of the General Regulation on Data Protection;
-The data controller did not adequately inform the data subjects about the processing of personal data, i.e. about the processing of data contained on copies of bank cards, which violated Article 13, paragraphs 1 and 2 of the General Data Protection Regulation;
-When creating a new business process for a quick payment service to a VISA bank card, the data controller did not implement appropriate technical and organizational measures, which violated Article 25, paragraph 1 and 2 of the General Data Protection Regulation;
-The controller did not apply a technical encryption measure to the personal data of the respondents stored in the controller's databases and did not regularly assess the effectiveness of technical and organizational measures to ensure the security of the processing, which violated Article 32, paragraph 1, points a) and d) of the General Regulation on Protection data.
-DPA determined that the processing or collection of copies of bank cards is not necessary in order to comply with legal obligations arising from the Anti-Money Laundering legislation, since the in-depth analysis of players can be carried out without collecting copies of both sides of bank cards. As a result of the above, the controller illegally processed copies of bank cards using inadequate means of processing and stored them without applying appropriate technical and organizational measures.
-Also, the data controller did not inform the data subjects about the processing in question (storage of copies of bank cards) in accordance with the principle of transparency, and thus the data subjects were deprived of basic information about data processing such as the legal basis, purpose and storage period. Namely, in the Statement on personal data protection measures, which forms part of the Privacy Policy, it was expressly stated that the data controller does not store bank card numbers and that the numbers are not accessible to unauthorized persons.
+The DPA also found that the controller stored these data for a period longer than necessary and contrary to the provisions of its own privacy policy, which stated that financial data would not be stored. It also found that the controller's employees, in the period between June and December 2022, had access to complete information on more than 655 copies of a total of 2078 collected copies of credit cards. Thus, it held that sufficient techniques and organization were not implemented to protect the rights of data subjects.
-However, employees of the controller in the period June - December 2022 had access to 655 copies of bank cards on which the full extent of data was visible out of a total of 2078 copies of bank cards collected. Such processing resulted in a high-risk violation of a third of the total processed data, and the data subjects were not even aware that this data was stored in databases.
+In addition, the DPA pointed out that the controller failed to inform the data subjects about the legal basis for the processing, its purposes and the period of storage of the data, violating the principle of transparency. It highlighted that financial data is considered a special category of data and its processing entails a high risk. Despite this, data subjects were not aware of all the information regarding its processing.
-Given that financial data is considered a sensitive category of personal data, which depending on the context and scope of processing can cause a high risk for the rights and freedoms of the data subject, the controller was obliged to pay special attention to the security and legality of the processing, which was taken taken into account as an aggravating circumstance.
+As mitigating circumstances, the DPA considered that the controller cooperated with the investigations and committed to adjust its conduct to the GDPR and to adopt measures to reduce the risks of handling financial information. For example, it committed to investing in the security of payment processing so that it is no longer necessary to send both sides of the credit card. In addition, it stated that it would delete the stored data and to train and monitor its employees.
-As a mitigating circumstance in the specific procedure, the degree of responsibility shown by the data controller after the supervision was carried out - on his own initiative, he informed the Agency about the way in which he plans to harmonize the processing with the provisions of the General Data Protection Regulation. Thus, the controller made additional investments in payment processes in such a way that the system was improved and that the delivery of a copy of the bank card is no longer requested, and that all stored copies of the bank cards were deleted. Also, the controller stated that he improved the business processes of monitoring the processing of personal data and educated employees.
+Still, a fine of €380,000 was imposed for the violation of the following GDPR Articles: [[Article 6 GDPR#1|6(1)]]; [[Article 13 GDPR#1|13(1)]] and [[13#2|(2)]];  [[Article 25 GDPR#1|25(1)]] and [[25#2|(2)]].
 == Comment ==