AZOP (Croatia) - Decision 28-08-2019
From GDPRhub
| AZOP (Croatia) - Decision of 28 August 2019 | |
|---|---|
 | |
| Authority: | AZOP (Croatia) |
| Jurisdiction: | Croatia |
| Relevant Law: | Article 4(1) GDPR Article 5(1) GDPR Article 6(1) GDPR Article 17(1) GDPR Article 25(1) GDPR Article 25(2) GDPR Article 100 Budget Act By-law Article 12 (5) Budget Act |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 28.08.2019 |
| Fine: | None |
| Parties: | Health Center |
| National Case Number/Name: | Decision of 28 August 2019 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Croatian |
| Original Source: | AZOP (in HR) |
| Initial Contributor: | tom_vranovic |
The Croatian DPA (AZOP) ordered the controller to comply with the data subject's erasure request, because it unlawfully published the data subject's personal data on their website, in violation of Article 5 and Article 6 GDPR.
English Summary
Facts
The controller is the Health Center (a health clinic) and had indicted the data subject (for unknown reasons). The data subject requested the Health Center to erase her personal data because her name and surname were published in a document called "Notes to the financial statements for the period from 1.1.2018 to 31.12.2018". This document was publicly available on the controller's website. The controller refused to comply with the data subject's request, so the data subject filed a complaint with the DPA.
The DPA requested the controller to stipulate the legal basis and purpose of the processing, and why they refused to comply with the data subject's request. The controller stated that it had a legal obligation to publish the personal data. They explained that, according to national law, they were obligated to publish annual financial statements on its website. Moreover, as part of this obligation, they must also publish details that provide further explanation to the financial data. These details were published in the above-mentioned document. Since the controller and the data subject were in a legal dispute, and information on disputes must be published in these financial notes, the controller claimed that it had to publish the data subject's personal data.
Holding
The DPA upheld the data subject's complaint.
The DPA considered that it follows from national law that the controller is obligated to publish an annual financial statement, with supplementary notes that provide further explanation on, inter alia, the controller's ongoing legal disputes. However, the national legislation does not prescribe that these notes must contain the name and surname of the parties in the dispute, since a description of the dispute suffices. Hence, the DPA concluded that the controller had no legal basis to publish the data subject's personal data, in violation of Article 5, Article 6, and Article 25 GDPR. It ordered the controller to comply with the data subject's erasure request pursuant to Article 17(1)(d) GDPR, and to take appropriate measures to protect personal data to ensure that the document is not searchable via Google search.
Comment
The DPA stated that the controller (also) violated Article 25 GDPR because they published the data subject's personal data on their website, without a legal basis. Unfortunately, the legal reasoning is unclear. One can assume that the controller neglected to implement appropriate technical and organisational measures that ensure adherence to data protection principles, such as the principle of data minimisation. However, a violation of (one of) these principles does not necessarily lead to a violation of Article 25 GDPR, and it is thus unclear what measures the controller had neglected to implement.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.
REPUBLIC OF CROATIA PROTECTION AGENCY PERSONAL DATA CLASS: REGISTRATION NUMBER: Zagreb, 28 August 2019 Personal Data Protection Agency pursuant to Article 57 (1) and (58) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to with the processing of personal data and on the free movement of such data and on revocation Directive 95/46 / EC (General Data Protection Regulation) SLEU L119 (hereinafter: General regulation) and Article 34. Of the Act Implementing the General Regulation on Data Protection, Official Gazette, no 42/18) and Article 42, paragraphs 1 and 2 and Article 96, paragraph 1 of the General Administrative Procedure Act (Official Gazette No. 47/09), upon request for protection of rights xy RESOLUTION 1. The request for a violation of the right to protection of personal data xy is founded. 2. It is established that by publishing the name and surname xy in the document “Notes to the financial reports for the period from 1.1.2018 to 31.12.2018. ”which was published online personal data was processed on the website of the Health Center contrary to Articles 5 and 6. General data protection regulations. 3. The Health Center is ordered to delete the personal data of person xy, and all other physical data persons listed in the document “Notes to the financial statements for the period from 1.1.2018-31.12.2018. ”Which was published on the website of the Health Center, a all in accordance with Article 17 (1) (d) of the General Data Protection Regulation. O b r a z l o ž e n j e The Agency for Personal Data Protection (hereinafter: the Agency) received a request xy (hereinafter) in the text: the applicant) stating that by publishing her personal data in document "Notes to the financial statements for the period from 1.1.2018 to 31.12.2018" and which is published on the website of the Health Center there was a violation of her personal data. The request is founded. Acting upon the received request, the Agency requested a statement from the Health Center Fr. the availability of the applicant's personal data, in particular on the legal basis and purpose of the publication personal data of the applicant. The health center has stated that it is obligated as a budget obligor in accordance with Article 12, paragraph 5 of the Budget Act and Article 27 of the Ordinance on Financial Accounting shall be published annually financial statements on its website no later than 8 days from the date surrenders. They further state that in accordance with Article 7, paragraph 2 of the said Ordinance, financially the report of budget users of the state budget for the budget year consists of Balance sheets, Statements of income and expenditure, receipts and expenditures, Statements of expenditure according to functional classification, reports on changes in value and volume of assets and commitment and Notes. They also state that, in accordance with Article 13 of the same Ordinance, the Notes are supplements data with the financial report, and in accordance with Article 14, the mandatory notes to the Balance Sheet are a list contractual relationships and the like that are the fulfillment of certain conditions may become a liability or an asset and a list of ongoing litigation. Since the Health Center has filed an indictment against him the applicants were obliged to state the same in the Notes. The General Data Protection Regulation stipulates in Article 4 (1) (1) that personal data are all data relating to an individual whose identity has been or can be established, and an individual whose identity can be established is a person who can be identified directly or indirectly, especially with help of identifiers such as name, identification number, location data, network identifier or by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual. In accordance with Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC hereinafter referred to as the General Data Protection Regulation personal data must be processed lawfully, fairly and transparently with respect to the respondent (principle of legality, fairness and transparency); collected in special, explicit and lawful purposes and may not be further processed in a way that is not in line with those purposes (principle purpose limitation); appropriate, relevant and limited to what is necessary in relation to the purposes in which they are processed (the principle of reducing the amount of data); accurate and up - to - date if necessary (principle accuracy); kept in a form that allows identification of respondents only for as long as it is necessary for the purposes for which personal data are processed (storage restriction principle); processed in a way that ensures adequate security of personal data, including protection against protection against unauthorized or unlawful processing and against accidental loss, destruction or damage by applying appropriate technical or organizational measures (principle of integrity and confidentiality). Article 6 of the General Data Protection Regulation stipulates that processing is lawful only if and in to the extent that at least one of the following is met: the respondent has given consent to processing their personal data for one or more special purposes; processing is necessary for execution a contract to which the respondent is a party or to take action at the request of the respondent before concluding contracts; processing is necessary to comply with the legal obligations of the processing manager; processing is necessary to protect the key interests of respondents or other natural persons; processing is necessary for the performance of a task of public interest or in the performance of the official authority of the controller; processing is necessary for the legitimate interests of the processing manager or a third party, except when they are from these interests are stronger interests or fundamental rights and freedoms of respondents that require the protection of personal data. Article 17 of the General Data Protection Regulation stipulates that the respondent is entitled to a leader processing to obtain the deletion of personal data relating to him without undue delay and the controller has an obligation to delete personal data without undue delay if any fulfilled one of the conditions, among other things, personal data are no longer necessary in relation to the purposes in which have been collected or otherwise processed. Article 25 of the General Data Protection Regulation stipulates that taking into account the latest achievements, the cost of implementation and the nature, scope, context and purposes of processing, as well as the risks of different level of probability and seriousness for the rights and freedoms of individuals arising from processing data, the controller, both at the time of determining the means of processing and at the time of processing, implements appropriate technical and organizational measures, such as pseudonymization, for enabling the effective application of data protection principles, such as volume reduction data, and the inclusion of safeguards in the processing in order to meet the requirements of this Regulation, and protect the rights of respondents. The processing manager implements the appropriate technical and organizational measures to ensure that only personal data that are necessary for each specific processing purpose. This obligation applies to the amount collected personal data, the scope of their processing, the storage period and their availability. More precisely, such measures ensure that personal data are not automatic, without the intervention of an individual, available to an unlimited number of individuals. The Budget Act (Official Gazette, Nos. 87/08 and 136/12, 15/15), more precisely Article 12. paragraph 5 stipulates that local and regional self-government units, budgetary and extrabudgetary users publish annual financial reports on their websites pages no later than eight days from the date of their submission. Ordinance on financial reporting in budget accounting (Official Gazette) No. 03/15, 93/15, 135/15, 2/17, 28/17 112/18) adopted pursuant to Article 100 of the Law on the budget stipulates that the notes supplement the data with the financial statements. Notes can be descriptive, numerical or combined. They are marked with ordinal numbers with reference to the AOP the label of the report to which they refer. Mandatory Notes to the Balance Sheet are: 1. List of contractors relationships and the like which, subject to the fulfillment of certain conditions, may become an obligation or an asset (given letters of credit, mortgages, etc.) and 2. List of pending litigation. List of litigation in the course referred to in paragraph 1 of this Article must contain a concise description of the nature of the dispute, an assessment of the financial the effect that may result from litigation as a liability or asset and the estimated time outflow or inflow of funds. Units of local and regional self-government, budgetary and extrabudgetary users publish annual financial reports on their websites pages no later than eight days from the date of their submission (Articles 13 and 14) Following the above in this administrative matter, it was determined that the personal data of the applicant requests more precisely her name and surname publicly available on the official website of the Health Center in the document “Notes to the financial statements for the period from 1.1.2018 to 31.12.2018.” It was further established that the said document was published in accordance with Article 12 of the Law on Budget and Article 27 of the Ordinance on Financial Reporting in Budget Accounting. Accordingly Articles 13 and 14 of the said Ordinance supplement the notes to the financial report and are part of the mandatory ones notes is a list of ongoing litigation. However the above special Act and on the basis it is not stated in the adopted Ordinance that the list of disputes must contain the name and surname persons / persons against whom the budget user is litigating it is already prescribed that the list should contain a concise description of the nature of the dispute, an assessment of the financial impact that may result from litigation as a liability or asset and the estimated time of outflow or inflow of funds. Therefore, the Health Center had a legal basis for publishing this document on the website, however, there is no legal basis and legitimate purpose for publishing the applicant's personal data requirements as well as all other natural persons with whom the Health Center in question is litigating thereby publishing personal data without a legal basis contrary to Articles 5, 6 and 25. General data protection regulations. Therefore, the Health Center is instructed as the treatment manager to when processing personal data that it processes and publishes in documents, it acts in accordance with it with the provisions of the General Data Protection Regulation, to delete the applicant's personal data and all other persons listed in the document in question in accordance with Article 17. paragraph 1 (d) and to take appropriate measures to protect personal data as the document does not would be searchable via Google search engine. Following the above, it was decided as in the operative part of the Decision. INSTRUCTIONS ON LEGAL REMEDY No appeal is allowed against this decision, but an administrative dispute may be initiated before the Administrative by the court within 30 days from the day of delivery of the decision.
