AZOP (Croatia) - Decision 18-12-2020
From GDPRhub
| AZOP - Decision of 18 December 2020 | |
|---|---|
 | |
| Authority: | AZOP (Croatia) |
| Jurisdiction: | Croatia |
| Relevant Law: | Article 5(1)(c) GDPR Article 6 GDPR Article 3 Zakon o medijima Article 7 Zakon o medijima Article 8 Zakon o medijima |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Decision of 18 December 2020 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Croatian |
| Original Source: | AZOP (in HR) |
| Initial Contributor: | co |
The Croatian DPA (AZOP) rejected a complaint by a data subject, a politician, as unfounded since it considered the information published in two news articles to be a matter of public interest.
English Summary
Facts
A media website published an article containing personal data about a data subject’s financial status, including a copy of the decision of the centre for social welfare granting him welfare and social benefits and the amounts thereof. Another website then published the same information and added that the data subject had been asked by the social welfare centre to do community service and failed to answer. The data subject in question is a politician and president of a political party in a Croatian town.
The data subject alleged that the editor had published personal data about his financial situation with the intention to discriminate against him by creating a “hostile, humiliating and insulting” environment. The media company submitted that it is among its tasks under the code of journalistic ethics to decide to publish certain information it believes to be in the public’s interest, as in this case.
The data subject still claimed that his personal data should not have been published and asserted that such data had been forwarded to other recipients without a legal basis and filed a complaint with the AZOP.
Holding
The AZOP considered the case in light of the GDPR and the Croatian Media Act (Zakon o medijima), which sets the conditions for information to be published on the media and guarantees freedom of expression, independence of the media, freedom to collect information and respect for human dignity. According to the Media Act, freedom of the media may only be restricted in a narrow set of cases where this is necessary in a democratic society, which also includes protection of the reputation or rights of others and prevent disclosure of confidential information. Article 7 of said act, however, states that public figures cannot expect the same level of protection as other citizens. Article 8 also states that when a justified public interest prevails, there can be no violation of the right to privacy. In addition to this, the Law on the Right to Access to Information stipulates that public authorities must publish information about granted grants and the beneficiaries thereof.
With regards to the articles in question, the AZOP held that the lawful basis for processing of personal data according to Article 6(1) GDPR are the provisions of the Media Act. As a consequence, the AZOP found that the information published about the complainant is to be considered a matter of public interest, especially given his political engagement.
Further, the AZOP did not consider that the controllers in this case failed to respect the principle of data minimisation of Article 5(1)(c) GDPR since information about these kinds of grants and how they are calculated is publicly available.
The AZOP thus rejected the complaint as unfounded.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.
1
REPUBLIC OF CROATIA
PROTECTION AGENCY
PERSONAL DATA
CLASS:
NUMBER:
Zagreb, December 18, 2020.
Personal Data Protection Agency based on Article 57, Paragraph 1 of Regulation (EU) 2016/679
of the European Parliament and the Council of April 27, 2016 on the protection of individuals in connection with processing
personal data and on the free movement of such data and on repealing the Directive
95/46/EC SLEU L119 (hereinafter: General Regulation), Article 34 of the Law on the Implementation of the General
Regulation on Data Protection ("Official Gazette", No. 42/18) and Article 96, Paragraph 1 of the Act on
general administrative procedure ("Narodne novine" no. 47/09), by official duty and occasion
requests for determining the violation of the right to protection of personal data XX from place XY brings
the following
SOLUTION
Request for determination of violation of the right to protection of personal data XX from place X
is rejected as unfounded.
Form layout
The Agency for the Protection of Personal Data (hereinafter: the Agency) received a request for
determination of violation of the right to protection of personal data XX from place X (hereinafter:
the applicant) in which he states that the responsible person in XY published his
personal data in the media with the intention of discriminating against him, specifically that he is on the X portal
published an article entitled "X" (URL: X) in which his personal information was published.
As an attachment to his request, the applicant submitted a copy of the article in question.
Upon receipt of the request in question, the Agency, by the Ombudsman, Trg
hrvatski velikana 6, Zagreb received for competent processing the complaint XX from place X
(of the applicant) in which the applicant points out that the responsible person is in XY in the local
to the media and announced on his Facebook page that he is the same beneficiary of rights from social welfare and
as his information was published with the aim of creating a hostile, humiliating and
offensive environment that leads to discrimination based on financial status. Additionally in his
the complainant points out that his personal data was published on the following internet sites
2
pages/portals X (URL:X), X (URL:X) and X (URL:X). Also, with the complaint
a copy of the first page of the Decision of the Center for Social Welfare X, CLASS: X, was also forwarded
ISSUE: X from June 11, 2018.
The request is not founded.
Acting on the request received and the complaint submitted by Pučki
of the ombudsman, the Agency requested the statement of XY i
responsible person XY regarding the forwarding of the applicant's personal data to others
recipients, as well as whether it is the same as a public authority, in accordance with Article 10, paragraph 1, point
8 of the Act on the right to access information on its website
information on granted grants and other assistance, including a list
user and amount.
Further to the request, the Agency received a statement from XY in which it states how
did not forward the applicant's personal data to other recipients and does not have it at its disposal
data on the amount of compensation that the applicant as a beneficiary of the right receives from the system
social welfare. Also, XY states that, as a public authority, it is not on its internet
did not publish any information on the granted grants on the pages, and so on
nor the list of beneficiaries and the amount.
Also, in a submission, CLASS: X, URBROJ: X, the Agency requested a statement from the company
X related to the applicant's statements as well as the legal basis and purpose for publishing personal data
of the applicant.
Further to the request, the company in question made a statement stating that it was on April 2
In 2020, the same published an article called "X" (URL:X) in which the name i
the surname of the applicant and the amount he receives annually from the Center for Social Welfare
X, in the interest of the public and the greater good, considering that XX performs in his public activity
as a politician and is also the president of the political party X based in X.
It is further stated that in the interest of the public and the greater good, the publications were checked
information about a political worker who is also the leader of a local party and is in line with it
their duty as media to question such information even if it is in the interest of the public
publish them in their medium.
Additionally, the company emphasizes that its task as a media is to stick to ethics
of the Journalist Code as well as publish information (including name and surname and key information for
specific case) if he considers that they are in the interest of the public.
Therefore, the company in question points out that it believes that the rights of the applicant are not
hurt considering that this is an active politician and media personality who publicly
has been active for years and is the leader of a political party.
In conclusion, the company points out that the information about the name and surname and the amount per year
fees (where they quoted XY) was used in the mentioned article and was not used in any other
purposes nor did it further process them.
3
From May 25, 2018, in all member states of the European Union, including in the Republic
The Regulation applies directly and bindingly to Croatia in the area of personal data protection
(EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals in relation to
with the processing of personal data and on the free movement of such data, as well as on its invalidation
Directive 95/46/EC (General Data Protection Regulation) SL EU 119.
The General Data Protection Regulation in Article 4, Paragraph 1, Point 1 stipulates that they are personal
data all data relating to an individual whose identity has been determined or can be determined, a
an individual whose identity can be established is a person who can be identified directly or
indirectly, especially with the help of identifiers such as name, identification number, information about
location, network identifier or with the help of one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that individual.
Personal data must be processed legally, fairly and transparently with regard to
of the respondent, collected for specific, express and lawful purposes, appropriate, relevant and limited
to what is necessary in relation to the purposes for which they are processed (principle of reducing the amount of data),
accurate and, if necessary, up-to-date, processed in a way that ensures adequate security
personal data, including protection against unauthorized or illegal processing and against accidental processing
loss, destruction or damage by applying appropriate technical or organizational measures
(principle of integrity and confidentiality) (Article 5 of the General Data Protection Regulation).
Article 6 of the General Data Protection Regulation stipulates that processing is lawful only if
and to the extent that at least one of the following is fulfilled: a) the respondent has given consent for
processing your personal data for one or more specific purposes; b) processing is necessary for
execution of a contract to which the respondent is a party or to take action upon request
of the respondent before the conclusion of the contract; c) processing is necessary to comply with the manager's legal obligations
processing; d) processing is necessary to protect the key interests of the data subject or other natural person;
e) processing is necessary for the performance of a task of public interest or in the exercise of official authority
processing manager; f) processing is necessary for the legitimate interests of the controller or a third party
parties, except when those interests are stronger than the interests or fundamental rights and freedoms of the respondents who
require the protection of personal data, especially if the respondent is a child.
Furthermore, we refer to the Media Act ("Official Gazette", number 59/04, 84/11 and 81/13)
which prescribes the conditions under which information can be published as well as the rights and obligations of journalists
(publisher), media principles and obligations, and we point out that in Article 3, paragraphs 1 and 2, it is prescribed
to guarantee freedom of expression and freedom of the media, which includes, among other things, freedom
expression of opinion, independence of the media, freedom of collection, research, publication and
distribution of information in order to inform the public, availability of public information and
respect for the protection of human personality, privacy and dignity.
Freedom of the media may be restricted only when and to what extent it is necessary
democratic society for the sake of, among other things, territorial integrity or public order and peace,
prevention of disorder or punishable acts, protection of health and morals, protection of reputation or rights of others,
4
to prevent disclosure of confidential information or to preserve authority (Article 3, paragraph 3
of the Media Act).
Also, the Law on Media in Article 7 paragraph 3 stipulates that a person who
statements, behavior and other acts related to her personal or family life alone
attracts public attention cannot demand the same level of privacy protection as other citizens.
There is no violation of the right to privacy if it prevails in terms of information
justified public interest over the protection of privacy in relation to the activities of journalists or to
information (Article 8 of the Media Act).
We emphasize that the Government of the Republic of Croatia, on the basis of Article 27 paragraph 1 of the Act on
of social care ("Official Gazette", number 157/13) issued a Decision on the basis for calculating the amount
guaranteed minimum fees, Class: 022-03/14-04/369, Registration number: 50301-04/12-14-2 dated 25.
September 2014, which in point I stipulates that the basis on which the amount is calculated
the guaranteed minimum fee is HRK 800.00.
In addition, we state that Article 10, Paragraph 1, Point 8 of the Law on the Right to
access to information ("Narodne novine", 25/13 and 85/15) prescribed that public authorities
mandatory to publish on websites in an easily searchable and machine-readable form
information about granted grants, sponsorships, donations or others
aid, including the list of beneficiaries and amount.
Following the above, in the conducted procedure based on established facts i
of the collected evidence in this administrative matter, it was established that company X is on its own
published a newspaper article called "X" (URL:X) on the website (portal X).
By inspecting it, it is clear that the applicant's name and surname are published in it
the information that the same quote "is a member of the household who is able to work and who from the Center for Social Welfare already
for a long time he receives annual compensation in the amount of HRK 9,600". Also, it is pointed out in the same that
the applicant as a person who heads a political party and as able-bodied
a member of the household receiving the guaranteed minimum compensation was obliged, in accordance with the provisions
of the Social Welfare Act, respond to XY's invitation to participate in works for the common good.
Also, from the submitted complaint of the applicant to the People's Republic
to the ombudsman, which was delivered to this Agency, it was established that company X, and company X,
X and X also published personal data on their websites (portals).
of the applicant.
By looking at the article called "X" (URL:X) which was published on the Internet
pages (portal) X and in the article called "X" (URL:X), it is clear that it is in the same
the published name and surname of the applicant and the information that XY according to the data of the Center for
social welfare sent social assistance beneficiaries an invitation to work for the common good, which they did not respond to
answered the applicant.
5
Since in this particular case it is about the publication of an article on the Internet
i.e. internet portal X (X and X), the Media Act is applied as a separate law
which represents the legal basis for the collection and processing of personal data in accordance with Article 6.
General regulations on data protection.
Therefore, it should be noted that company X (that is, company X and company X)
lawfully collected the applicant's personal data since the same has a legal basis for
collection of information that may contain personal data of natural persons in accordance with the Law
about the media and that it has the right to inform the public about matters of public interest. Therefore taking
taking into account the above-mentioned Article 8 of the Media Act, in the specific case the public one prevails
interest in information about work for the common good of social assistance beneficiaries on call
XY over the protection of privacy and protection of personal data of the applicant. Especially because
in the specific case, the petitioner is a public person, at the head of a political party, who,
taking into account article 7 paragraph 3 of the Law on Media, it cannot demand the same level of protection
privacy like other citizens.
Also, related to the application of Article 5 of the General Regulation on data protection, especially important data
we state that the data controller should take care during each processing (publication) of personal data
on the purpose of processing (publication) of personal data, i.e. whether the processing (publication) of personal data
justified (legal), whether there is a legal basis for the processing (publication) of personal data and in
in the case when the existence of a justified (legal) purpose and legal basis for processing is established
(publication) of personal data must be guided by the principle of reducing the amount of data to
way that it is permissible to publish only the most necessary scope of personal data, depending on the purpose for which
personal data is published, and what is company X (that is, company X and company X) is described
the case did.
Accordingly, and taking into account the principles of processing from Article 5 of the General Regulation on Protection
data, especially the principle of reducing the amount of data, it should be pointed out that company X
as the processing manager in the specific case processed the applicant's personal data in
minimum scope (name and surname and the amount of the minimum fee on an annual level).
In this regard, it should be noted that the basis on which the amount is calculated is
guaranteed minimum compensation prescribed by the Government Decision and the same amounts to HRK 800.00, respectively
it is an amount that is publicly available. It is also necessary to refer to the provisions of the Act on
the right to access information and the duty for public authorities to take care of transparency
spending public funds from its budget. That is how the law in question is in Article 10, paragraph
1, point 8, prescribed the obligation of public authorities to publish information about the allocated
grants, sponsorships, donations or other assistance, including a list
user and amount.
Therefore, in the specific case, it was determined that when the article was published, company X
(ie company X and company X) took care to protect the privacy of the applicant and
processing principles from Article 5 of the General Data Protection Regulation.
6
As a result of the above, in the entire procedure, it was determined that it is for publication
of personal data found in the article called "X" (URL: X) as well as articles under
under the name "X" (URL:X) and "X" (URL: X) there was a legal basis from Article 6 of the General Regulation on
data protection and that the applicant's rights were not violated by publishing the name and surname.
Thus, it was determined that the said processing was not excessive, especially taking into account the scope
published data and the fact that in this particular case it is also about the spending of public funds
and that the applicant is a public person. Therefore, the described procedure did not occur
violation of the right to protection of personal data of the applicant.
In accordance with what was stated, it was decided as in the wording of the decision.
LEGAL REMEDY
An appeal against this decision is not allowed, but an administrative dispute can be initiated before the Administrative Court
by the court in X within 30 days from the date of delivery of the decision.
DEPUTY DIRECTOR
Igor Vulje, B.Sc. Crimea.
Deliver:
1. XX
2. X
3. X
4. X
5. X
6. Stationery, here
Note:
Ombudsman, Trg hrvatskih velikana 6, Zagreb
