US Zagreb - Us I-4594/2023-5
From GDPRhub
| US Zagreb - Us I-4594/2023-5 | |
|---|---|
 | |
| Court: | US Zagreb (Croatia) |
| Jurisdiction: | Croatia |
| Relevant Law: | Article 27 (1) ZPOUZP Article 27 (2) ZPOUZP Article 83 (2) ZPOUZP Article 51 ZPOUZP |
| Decided: | 29.08.2024 |
| Published: | 18.10.2024 |
| Parties: | A AZOP (the DPA) |
| National Case Number/Name: | Us I-4594/2023-5 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Croatian |
| Original Source: | Tražilica odluka sudova RH (in Croatian) (in Croatian) |
| Initial Contributor: | leeve |
A €3,500 fine was upheld for a controller's failure to display proper video surveillance notices, violating Article 27 of ZPOUZP.
English Summary
Facts
The applicant, A (the controller) raised a complaint for annulment of a decision issued by AZOP (the DPA). With that decision, the DPA held that the controller failed to display the video surveillance notice when posting the notice on video surveillance against Article 27 ZPOUZP. Also, it was established that the controller failed to display all relevant information and by doing so, violated Article 27 (2) ZPOUZP. Also, in accordance with Article 51 (1) ZPOUZP he was obliged to pay an administrative fine of 3.500,00 EUR.
The controller argued the penalty was disproportionate, citing mitigating factors such as prior compliance, lack of harm to individuals, and immediate corrective actions. He also claimed the DPA failed to properly assess circumstances and should have issued a warning or lesser penalty instead.
The court stated that under Article 51 ZPOUZP, an administrative fine of up to HRK 50.000,00 is mandatory for failing to properly mark premises as required by Article 27 of ZPOUZP. Therefore, there was no legal basis for issuing only a warning or ordering the elimination of the irregularities.
The court noted that the DPA has the legal authority to impose administrative fines as appropriate measures for each violation of rights. It further stated that the controller's challenge to the adequacy and choice of the fine was unnecessary and unauthorized.
Furthermore, the controller argued that he had never received complaints regarding video surveillance or data processing, but the court deemed this irrelevant to his obligation to comply with legal provisions. While he emphasized his cooperation during supervision and claimed mitigating circumstances, the court found these efforts insufficient to impact the case. The controller ultimately acknowledged his failure but argued that any fine should be minimal. The court concluded that the DPA acted impartially and lawfully, basing its decision on relevant facts and evidence.
Holding
The Court held that the controller's complaint for the annulment of a decision issued by the DPA was unfounded and, therefore, rejected.
Furthermore, the Court held that the controller was not entitled to the reimbursement of costs incurred in the administrative dispute, as the claim was also dismissed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.
REPUBLIC OF CROATIAADMINISTRATIVE COURT IN ZAGREBAvenija Dubrovnik 6 and 8Registration number: Us I-4594/2023-5IN THE REPUBLIC OF CROATIAJUDGMENTThe Administrative Court in Zagreb, by the judge of that court, Jasna Peroš Nikolić, as a single judge, with the participation of the recorder, Anđela Hambašić, in the administrative dispute of the plaintiff E. d.o.o. from Z., represented by attorney H. M., attorney in Z., against defendant A. for the protection of personal data, Z., for the protection of personal data, August 29, 2024, judgment I The claim for annulment of A.'s decision for the protection of personal data, CLASS: UP/I-034-01/23-01/18, REGULATION NUMBER: 567-02/16-23-01 of August 21, 2023, is rejected. II The plaintiff's claim for reimbursement of the costs of the administrative dispute is rejected. Reasoning 1. The contested decision of the defendant established that the controller of the plaintiff, contrary to Article 27, paragraph 1 of the Act on the Implementation of the General Data Protection Regulation, failed to display the video surveillance notice when posting the video surveillance notice in/on the plaintiff's premises at the addresses Z., and it was established that the controller of the plaintiff, contrary to Article 27, paragraph 2 of the same Act, failed to indicate all relevant information, in particular data on the controller and contact details through which the data subject can exercise his/her rights, and for which he/she complies in accordance with the provision of Article 51, paragraph 1 of the Act on the Implementation of the General Data Protection Regulation, an administrative fine of EUR 3,500.00 is imposed on him/her, which he/she is obliged to pay within 15 days from the date of the finality of that decision, with a warning that if he/she fails to pay the fine within the prescribed period, the fine will be collected by force in accordance with the regulations on forced collection of taxes.2. The plaintiff challenges the legality of the contested decision by filing a lawsuit, essentially stating that the defendant could have issued him an official warning instead of a fine or ordered him to bring the processing procedures into line with the provisions of the Regulation within a certain period. He also states that, in accordance with Article 51 of the Act on the Implementation of the General Regulation on the Protection of Personal Data, a possible fine for an established violation may be imposed in the amount of up to HRK 50,000.00. The plaintiff points out that the defendant did not properly assess aggravating and mitigating circumstances. He points out that the defendant considers the fact that, after the inspection, he did not inform the defendant of the subsequent actions taken and the posting of appropriate video surveillance notices as an aggravating circumstance. He believes that the above cannot be assessed as an aggravating circumstance, since he was not warned of the shortcomings in the video surveillance notices during the inspection, nor could he have concluded this from the minutes. This is supported by the fact that immediately upon receipt of the contested decision, within a few days, he took all appropriate measures and posted the correct video surveillance notices. He points out that he was at least verbally warned by the defendant during the inspection that the notices were incorrect, he would have immediately removed the said violation and notified the defendant thereof. He states that the defendant himself points out in the decision that he duly cooperated during the inspection and submitted all necessary documents for inspection, which proves his good will to conduct his business in accordance with the Regulation and that any shortcomings are unintentional, which the defendant also confirms, stating that there was no direct intention to violate the provisions of the Regulation. He proposes to conduct evidence by hearing witness B. N., an employee of the plaintiff. He believes that for any lack of information on the video surveillance notice, he should not be punished as if he had not posted the video surveillance notice at all. He believes that each respondent was nevertheless warned and knew that the premises were being recorded, and therefore the possible omission of additional information did not cause the respondent any specific damage in this case. In doing so, he believes that the fact that he has never received a request, inquiry or complaint from any respondent regarding video surveillance or data processing in general should be taken into account. He notes that he has never previously acted contrary to the Regulation, nor has a measure been imposed against him, nor has he been punished by any other supervisory authority. He also considers the fact that he did not make any financial gain or avoid any losses from the said violation to be a mitigating circumstance. He believes that the imposed penalty is not justified because it is not in accordance with the principle of proportionality, especially considering a number of circumstances on his side and the fact that it is evident from the supervision carried out that he cares about protecting the personal data of the respondents, and he believes that the warning itself and the minimum fine are sufficiently effective measures in this case. 3. He proposes that the Court adopt the claim and annul the contested decision with reimbursement of the costs of the administrative dispute for the preparation of the claim. 4. In his response to the claim, the defendant essentially states that the allegations in the claim are unfounded. It points out that in the above administrative matter it acted in accordance with the provisions of Article 57, paragraph 1 and Article 58, paragraph 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) OJEU L119, which, first of all, protects the personal data of natural persons, i.e. supervises the collection, processing and use of personal data, and on the basis of the collected and submitted evidence of the established facts, it correctly applied procedural and substantive law and issued the contested decision. Therefore, the defendant still maintains all the allegations made in the contested decision and emphasizes that it acted within the limits of its authority and in accordance with the provisions of the General Data Protection Regulation, the Act on the Implementation of the General Data Protection Regulation and the Act on General Administrative Procedure. In relation to the plaintiff's allegations that the defendant could have issued an official warning or ordered the elimination of irregularities for the established violations, he states that Article 51 of the Act on the Implementation of the General Data Protection Regulation, among other things, stipulates that an administrative fine of up to HRK 50,000.00 shall be imposed on the controller and processor who fail to mark the facility, premises, parts of the premises and the external surface of the facility in the manner prescribed in Article 27 of this Act. Therefore, it is clear that the plaintiff's allegations that he should have only been ordered to eliminate irregularities are not based on the law, because the cited article stipulates that an administrative fine shall be imposed for a violation of Article 27 of the Act on the Implementation of the General Data Protection Regulation. Additionally, bearing in mind the fact that the defendant has the legal authority to impose administrative fines as adequate measures in each individual case of established violation of rights, it emphasizes that the plaintiff has completely unnecessarily and without authorization engaged in questioning the adequacy and choice of the measure that the defendant imposed on the plaintiff in this specific case (administrative fines). In relation to the plaintiff's allegations that the defendant did not warn him of the shortcomings in the video surveillance notifications and that he could not conclude from the minutes that there were shortcomings, because otherwise he would have immediately corrected all the omissions, the defendant emphasizes that the above is not an obligation of the supervisory authority when compiling the minutes of the situation on the ground, but rather an obligation of the controller (the defendant) to apply the provisions of the General Data Protection Regulation and the Act on the Implementation of the General Data Protection Regulation. Thus, the obligation to apply, among other things, Article 27 of the Act on the Implementation of the General Data Protection Regulation, which concerns the existence and necessary content of the video surveillance notice, existed before the surveillance was conducted and the minutes were drawn up, and it also exists afterwards, and the plaintiff must have been aware of this and implemented the legal provisions in practice. Finally, it states that it is a well-known legal principle that ignorance of positive laws does not excuse anyone. It further states that the plaintiff's theses that for possible shortcomings in the video surveillance notice he should not be punished as if he had not submitted it at all are unfounded, that it was necessary to take into account that the plaintiff never received a query or complaint from a respondent, either related to video surveillance or in general the processing of personal data, and that he cooperated during the surveillance by submitting the necessary documents for inspection, thus proving his good will to bring his business operations into line with the provisions of the General Data Protection Regulation. The plaintiff points out in his defense that he never received a query or complaint from a respondent, either related to video surveillance or in general the processing of personal data, but that the aforementioned is not relevant to his obligation to comply with the legal provisions. In the end, the plaintiff tries to downplay the significance of his failure to comply with the legal regulations by indicating that he cooperated during the supervision by submitting the necessary documents and thus demonstrated his good will to bring his business operations into line with the provisions of the General Data Protection Regulation, which, given the nature of the established violation of the legal regulations, had no impact on the resolution of the specific administrative matter. The above is supported by the fact that, in concluding his complaint, the plaintiff once again exceeds the defendant's legal powers and engages in the assessment of alleged mitigating circumstances and feels the need to emphasize his concern for the rights of the data subjects, but in the end he nevertheless gives in, admitting his failure, stating that in this specific case there is room for imposing a fine (of course, in the plaintiff's opinion, it should be minimal). The legal basis for the adoption of the decision itself in terms of the powers of the supervisory authority is clearly stated in the contested decision and the defendant believes that there is no need to repeat it. In conclusion, the defendant points out that he acted impartially and objectively in this administrative matter, and made a decision taking into account all the facts and evidence that he considered relevant for making a correct and lawful decision.5. He proposes that the Court reject the claim as unfounded.6. Since the conditions set out in Article 98, paragraph 1, item 4 of the Administrative Disputes Act (Official Gazette, No. 36/24 - hereinafter referred to as the ZUS) were met in this specific case, the Court resolved the dispute without a hearing, and after the parties, in accordance with Article 6 of the ZUS, were given the opportunity to state their views on the requests and allegations of the other parties and on all issues that are the subject of this administrative dispute.7.In order to assess the legality of the contested decision, the Court reviewed the court file and the documents attached to the defendant's file.8. Based on the consideration of all factual and legal issues, the Court found the claim unfounded.9. From the data in the case file, submitted to this Court with the response to the claim, it follows that the defendant conducted direct supervision of the processing and implementation of personal data protection regarding the collection and processing of personal data made by the video surveillance system installed in/on the plaintiff's premises at the addresses Z., and a report on the supervision conducted on 4 April 2023 was drawn up, which established certain irregularities, which the plaintiff does not dispute but believes that he could have been imposed a more lenient measure.10. Article 51 of the Act on the Implementation of the General Data Protection Regulation (Official Gazette, No. 42/18), among other things, stipulates that an administrative fine of up to HRK 50,000.00 shall be imposed on the controller and processor who fail to mark the facility, premises, parts of the premises and the external surface of the facility in the manner prescribed by Article 27 of that Act.11 Therefore, the plaintiff's allegations that he should have only been ordered to remove the irregularities are unfounded, since the aforementioned article stipulates that an administrative fine shall be imposed for a violation of Article 27 of the Act on the Implementation of the General Data Protection Regulation. The amount of the fine is explained in the contested decision, which explanation this Court accepts, since the defendant assessed all the circumstances of the case at hand, and in particular that the selected corrective measure must be effective, proportionate and dissuasive in each individual case, which he has explained. The defendant imposed the fine taking into account the criteria prescribed in Article 83, paragraph 2 of the General Data Protection Regulation, while also seeking to ensure that the rules on personal data protection are respected by the controller itself, which processes the personal data of the data subjects in connection with the video surveillance system, as well as general deterrence (discouraging others from repeating the same violation in the future) and specific deterrence (discouraging the plaintiff from repeating the same violation).12. Therefore, the Court cannot assess the contested decision of the defendant, with the reasoning given therein, as unlawful, where the objections raised by the plaintiff in the complaint are unfounded and the truth indicates that different decisions in this administrative matter are required.13. Therefore, the Court assessed the plaintiff's evidentiary proposal for the hearing of witness B. N., an employee of the plaintiff, as ineffective.14. Therefore, it was necessary, pursuant to Article 116, paragraph 1 of the Administrative Disputes Act, to rule as in point I of the operative part of the judgment15. The decision on the costs of point II of the operative part of the judgment is based on Article 147, paragraph 1 of the Administrative Disputes Act. In Zagreb, 29 August 2024. Judge: Jasna Peroš Nikolić, acting. Instruction on legal remedy: An appeal against this judgment is allowed to the Fifth Administrative Court of R. H.. The appeal is filed through this Court, in a sufficient number of copies for the Court and all parties to the dispute, within 15 days from the date of delivery of this judgment.
