AZOP (Croatia) - Decision 08-03-2022 (energy company)

AZOP (Croatia) - Decision of 8 March 2022 - Unknown energy company
Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 15(3) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	08.03.2022
Fine:	940000 HRK
Parties:	n/a
National Case Number/Name:	Decision of 8 March 2022 - Unknown energy company
European Case Law Identifier:	CRO
Appeal:	Unknown
Original Language(s):	Croatian
Original Source:	AZOP (in HR)
Initial Contributor:	Presido Croatia

The Croatian DPA (AZOP) imposed a fine of HRK 940,000 (approx. €120,000) on an controller for failing to submit video surveillance recordings (copies of personal data) at the request of data subject, in violation of Article 15(3) GDPR.

English Summary

Facts

The controller is an energy sector company that exploits gas stations. The data subject tried to refuel at one of the controller's gas stations and was dissatisfied with the measurement of the measurement. Consequently, he filed a complaint in accordance with consumer protection regulations. To strengthen his complaint, he requested a copy of the video surveillance recordings, specifying the date and time of the event. Hence, he requested a copy of his personal data pursuant to Article 15(3) GDPR. The controller, however, rejected the request on the grounds that there was no written request from the authorities to provide a copy of the recording, that the purpose of the request was not justified, and that obtaining such a copy would adversely affect the rights and freedoms of gas station employees and customers who were there at that moment.

The data subject then filed a complaint with the DPA for a violation of Article 15(3) GDPR.

Holding

The DPA upheld the complaint.

After the DPA initially published an opinion on the obligation of the controller to provide the data subject with copies of the requested video surveillance recording, the controller replied that they could not provide the requested recording due to fact they destroy recordings after seven days. The DPA then found that the controller violated the data subject's right of access, by denying him the right to obtain a copy of the video surveillance recording. Hence, the controller decided to impose a fine on the controller.

Regarding the height of the fine, the DPA considered that the violation did not only cause indirect material damage to the data subject, but also gained a financial benefit from the violation, since it avoided the financial damage it might have suffered as a result of the consumer dispute with the data subject. The DPA emphasised that it cannot determine whether the data subject is entitled to compensation for damages in his consumer protection dispute. However, the DPA considered that the a fine of HRK 940,000 (approx. €120,000), for the violation of Article 15(3) GDPR, was sufficient.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

The Agency for Personal Data Protection imposed an administrative fine in the amount of HRK 940,000.00 on the head of processing or the company in the energy sector (hereinafter: the Company) for failure to submit video surveillance camera footage (copies of personal data) at the request of respondents. infringements of Article 15 (3) of the General Data Protection Regulation.

The Agency received a request for a violation of the right to protection of personal data from the respondent who requested the Company to submit video surveillance camera footage of the applicant (respondent). Namely, the applicant used the services of a petrol station at one of the Company's branches and, due to dissatisfaction with the measurement of refueling, filed a complaint in accordance with consumer protection regulations. After that, in order to better protect his consumer rights, he requested the delivery of copies of his personal data via a copy of the video surveillance camera footage, specifying the date and time. The Company rejected such a request on the grounds that it considered that there was no written request from the competent authorities to provide a copy of the recording, that the purpose of the request was not justified and that obtaining such a copy would adversely affect the rights and freedoms of gas station employees and customers. at that moment. In his address to the Company, the applicant warned of the possibility of contacting the Agency in case of violation of his rights to personal data protection.

After the Agency, at the prior request of the applicant, gave a general opinion on the obligation of the head of personal data processing to provide respondents with copies of the requested video surveillance footage, the Company replied that the applicant could not provide the requested footage due to archives. the site clears after seven days.

In the present case, the right to access personal data was violated, ie to obtain a copy of the applicant's personal data, as one of the fundamental rights of the respondent, by denying him the right to obtain a copy of the video surveillance camera footage of the applicant. the General Regulation on Data Protection prescribes the imposition of administrative fines in accordance with Article 83, paragraph 5, item b), or administrative fines in the amount of up to EUR 20,000,000 or in the case of entrepreneurs up to 4% of the total annual worldwide turnover for the previous financial year, whichever is greater.

In this administrative matter, not only indirect material damage to the applicant was established, but also the possible financial benefit of the Company, which by not submitting the recording and its subsequent deletion after seven days indirectly avoided financial damage it could suffer due to consumer dispute with the applicant. , and by not submitting the recording it eliminated possibly important evidence in a special proceeding. We emphasize that the Agency is not authorized to determine whether the damage actually occurred and its amount, but if the damage was due to violation of the General Data Protection Regulation or if there is such a possibility, then the Agency should take this fact into account when assessing the amount of administrative fines. .