Ž. sud u Zagrebu - P-242/2024-27
From GDPRhub
| Ž. sud u Zagrebu - P-242/2024-27 | |
|---|---|
 | |
| Court: | Ž. sud u Zagrebu (Croatia) |
| Jurisdiction: | Croatia |
| Relevant Law: | Article 51 GDPR Article 82 GDPR |
| Decided: | |
| Published: | |
| Parties: | |
| National Case Number/Name: | P-242/2024-27 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Croatian |
| Original Source: | Ž. sud u Zagrebu (in Croatian) |
| Initial Contributor: | RP |
A court held that it lacked jurisdiction to assess the lawfulness of a processing in relation to a dispute between a telecom provider and a data subject. It held that the national DPA would be competent and therefore rejected a damage claim by the data subject.
English Summary
Facts
A data subject sued a telecommunication provider in Croatia, A1 Hrvatska,. The data subject claimed that the controller wrongly processed their personal data and caused harm. The case concerned debt collection communications. The data subject argued that the debt did not belong to them and that the controller’s calls and emails violated the GDPR. They asked the court for €200,000 in damages for emotional distress, reputational harm, and financial consequences. The controllers denied any wrongdoing. They stated that they lawfully processed the data and that the data subject did not prove any damage. They also stated that questions about GDPR compliance first had to go to the Croatian Data Protection Agency (Agencija za zaštitu osobnih podataka – AZOP).
Holding
The court dismissed the case regarding the GDPR claims, only recognizing it's competence to decide on GDPR unrelated damages. The court held that it did not have jurisdiction to decide on GDPR violations, because these were within the competence of DPA's under Article 51 GDPR and consequently the data subject first needed to bring the matter to AZOP.
The court then recognized that data subjects can ask for non-material damages but that the data subject did not prove any unlawful processing or any damage. Because of this the claim for compensation failed. The court ordered the data subject to pay the controllers' legal costs.
Comment
The judgment contains a structural inconsistency. The court first stated that it lacked competence to assess GDPR issues based on Article 51 GDPR, without addressing the relevance of Articles 78, 79 and 82 GDPR, which provide judicial remedies and compensation rights. Despite declaring a lack of jurisdiction, the court then proceeded to analyse the merits and acknowledged that data subjects may seek compensation under Article 82 GDPR.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
REPUBLIC OF CROATIAMUNICIPAL COURT IN NOVI ZAGREBNovi Zagreb - Istok, Turinina 3Case number: P-242/2024-27IN THE REPUBLIC OF CROATIAJUDGMENT Municipal Court in Novi Zagreb, by judge Marina Nikolić as an individual judge, in fact the plaintiff UPF from [address], OIB: [personal identification number], against the first defendant A1 Hrvatska d.o.o., Zagreb, Vrtni put 1, OIB: 29524210204, represented by attorney-at-law Sanela Jurković, attorney in Zagreb, the second defendant CEI Zagreb d.o.o., Zagreb, Ul. Damira Tomljanovića Gavrana 11, OIB: 57423921801, represented by attorney Vlatka Nadrami, attorney in Zagreb, and the third defendant Attorney UP from [address], OIB: [personal identification number], represented by attorney Mateja-Ana Majdak Juranović, attorney in Zagreb, for the purpose of payment, after the main and public hearing held and concluded on 26 August 2025 in the presence of the plaintiff in person, the first defendant through attorney Sanela Jurković, attorney, the second defendant through attorney Vlatka Nadrami, attorney, and the third defendant in person, on 10 October 2025.judgement is given by I. This court is declared incompetent, all actions taken are annulled and the lawsuit is dismissed in the part that reads: "It is established that A1 Hrvatska d.o.o., without a valid legal basis, after the termination of the subscription contract and the duly returned equipment, unlawfully continued to process, transfer and use the personal data of the plaintiff UPF, thereby violating the provisions of the General Data Protection Regulation (GDPR), in particular Articles 5, 6, 12-21, 30, 33, 34, 82 of the GDPR, as well as recitals 39, 65, 85, 86, 87, 146, 173 of the GDPR. A1 Hrvatska d.o.o. is ordered to: deliver to the plaintiff in writing all data and documentation it possesses and processes about the plaintiff UPF, including: records of all categories of personal data and the purpose of the processing, the legal basis and the data retention periods, records of all access to data and forwarding to third parties (a list of all natural and legal persons who had access or to whom the data was forwarded), all internal minutes, access logs, and a list of all actions related to the personal data of the plaintiff, copies of all communications and recordings of conversations, decisions on processing and assessments of legitimate interest, reports and minutes of all personal data breaches, internal investigations and reports to supervisory authorities, records of data destruction or deletion, contracts and decisions on forwarding data to processors or other partners, all responses and actions taken upon the plaintiff's requests pursuant to Articles 15, 16, 17, 18, 19, 20, 21, 30, 33 and 34 of the GDPR, to delete all personal data of the plaintiff from its records and all related systems and databases within 8 (eight) days, unless there is an explicit legal basis for retention for individual data (which must be proven to the court and the prosecutor in writing), to inform the prosecutor and the court in writing of all actions from points 2 and 3 within 8 days of their execution; to permanently prohibit further processing and forwarding of the personal data of the plaintiff to any third party, except when expressly prescribed by law, with a special obligation to report to the court on any such case. It is established that CEI Zagreb d.o.o., after taking over the data from A1 Hrvatska d.o.o., without a valid legal basis and without prior verification of the facts, unlawfully processed, used, shared and forwarded the personal data of the plaintiff UPF, and undertook aggressive collection actions and created psychological pressure, thereby violating the provisions of the General Data Protection Regulation (GDPR), in particular Articles 5, 6, 12-21, 30, 33, 34, 82 of the GDPR, as well as recitals 39, 65, 85, 86, 87, 146, 173 of the GDPR. CEI Zagreb d.o.o. is ordered to: deliver to the plaintiff in writing all data and documentation it possesses and processes about the plaintiff UPF, including: records of all categories of personal data and purposes of processing, legal basis and data retention periods, records of all persons and employees who accessed his data, a list of all third parties or organizations to whom the data was forwarded (including A1, lawyers, external collaborators), all internal minutes, access logs and a list of all actions related to the plaintiff's personal data, copies of all communications and recordings of conversations, decisions on processing and assessments of legitimate interest, reports and minutes of all personal data breaches, internal investigations and reports to supervisory authorities, records of data destruction or deletion, contracts and decisions on forwarding data to third parties or partners, all responses and actions taken upon the plaintiff's requests under Articles 15, 16, 17, 18, 19, 20, 21, 30, 33 and 34 of the GDPR; delete all personal data of the plaintiff from its records and all related systems and databases, unless there is an explicit legal basis for retention for certain data (which must be proven to the court and the prosecutor in writing); notify the prosecutor and the court in writing of all actions from points 2 and 3 within 8 days of execution; permanently prohibit any further processing, communication, collection or contact with the plaintiff regarding the “debt” in question, except when expressly prescribed by law and with the prior written consent of the court and the prosecutor; permanently prohibit the forwarding or sharing of the plaintiff's personal data to any third party, except when expressly prescribed by law, with a special obligation to report to the court on any such case. It is established that the UP lawyer, based on the information he received from A1 Hrvatska d.o.o. and/or CEI Zagreb d.o.o., without a valid legal basis, using inaccurate and incomplete data, contrary to the principles and provisions of the General Data Protection Regulation (GDPR), in particular Articles 5, 6, 12-21, 30, 33, 34, 82 of the GDPR, as well as Recitals 39, 65, 85, 86, 87, 146, 173 of the GDPR, continued to process, forward, use and utilize the personal data of the plaintiff UPF in various court and enforcement proceedings, thereby causing material and non-material damage to the plaintiff. The UP attorney is ordered to deliver to the plaintiff in writing, within 8 (eight) days from the date of the finality of the judgment, all data and documentation in his possession and processing on the plaintiff UPF, including: records of all categories of personal data and purposes of processing, legal basis and data retention periods, records of all persons and collaborators who accessed his data (including external collaborators, courts, notaries public), a list of all third parties or organizations to whom the data was forwarded or became available, all internal records, access logs and a list of all actions related to the personal data of the plaintiff, copies of all communications (letters, e-mails, letters to the court, notaries public and parties), reports and minutes of personal data breaches, internal investigations and reports to supervisory authorities, records of data destruction or deletion, contracts and decisions on forwarding data to third parties or partners, all responses and actions taken upon the plaintiff's requests under Articles 15, 16, 17, 18, 19, 20, 21, 30, 33 and 34 of the GDPR; to delete all personal data of the plaintiff from its records and all related systems and databases within 8 (eight) days, unless there is an explicit legal basis for retention for individual data (which must be proven to the court and the plaintiff in writing), to inform the plaintiff and the court in writing of all actions from points 2 and 3 within 8 days of execution; to immediately take all necessary measures to correct and withdraw all initiated enforcement and other proceedings against the plaintiff that are based on disputed and inaccurate data; to permanently prohibit any further processing, forwarding or use of the plaintiff's personal data in any new or future proceedings, except when expressly prescribed by law and with the prior written consent of the court and the plaintiff. "II. The claim is rejected as unfounded in the part that reads: "A1 Hrvatska d.o.o. is ordered to pay the plaintiff, within 8 (eight) days from the date of the final judgment: jointly and severally with the other defendants, the amount of EUR 200,000.00, or the amount that the court considers fair, for material and non-material damage, with statutory default interest from the date of filing the lawsuit until payment; pay the plaintiff the costs of the civil proceedings according to the court's decision, to send the plaintiff an apology in writing for the unlawful processing of personal data, violation of personality rights and all harmful consequences, and to send this apology in the same form in which the plaintiff was contacted for the non-existent debt (by post and e-mail). CEI Zagreb d.o.o. is ordered to pay the plaintiff, within 8 (eight) days from the date of the final judgment: jointly and severally with the other defendants, the amount of EUR 200,000.00, or the amount that the court deems it fair, for material and non-material damages, with statutory default interest from the date of filing the lawsuit until payment, pay the plaintiff the costs of the civil proceedings according to the court's decision, to send the plaintiff an apology in writing for the unlawful processing of personal data, the violation of personality rights and all harmful consequences, and to send this apology in the same form in which the plaintiff was contacted (by mail, e-mail, telephone). The UP lawyer is ordered to: within 8 (eight) days from the date of the final judgment: jointly and severally with the other defendants, pay the plaintiff the amount of EUR 200,000.00, or the amount that the court deems fair, for material and non-material damages, with statutory default interest from the date of filing the lawsuit until payment, pay the plaintiff the costs of the civil proceedings according to the court's decision, to send the plaintiff an apology in writing for the unlawful processing of personal data, the violation of personality rights and all harmful consequences, and to send this apology in the same form in which the plaintiff was contacted (by post and e-mail)."III. The plaintiff UPF is ordered to reimburse the first defendant A1 Hrvatska d.o.o. for the costs of the proceedings in the amount of 9,030.00 euros, within 15 days.IV. The plaintiff UPF is ordered to reimburse the second defendant CEI Zagreb d.o.o. for the costs of the proceedings in the amount of 11,286.04 euros, within 15 days.V.The plaintiff UPF is ordered to reimburse the costs of the proceedings to the third defendant UP in the amount of 7,525.00 euros, within 15 days. Reasoning 1. The plaintiff states in the lawsuit and in the further course of the proceedings that in January 2023 he terminated the Contract concluded with the first defendant A1 Hrvatska d.o.o. and returned their equipment on 17 February 2023, however, the first defendant continues to send invoices in March, falsely stating that the plaintiff did not return the equipment. Shortly after that, the plaintiff is called by CEI Zagreb d.o.o. and begins to harass and extort money from him with constant messages and calls. The plaintiff states that they called him hundreds of times, used his personal data, abused him with messages and calls. He believes that his data was collected illegally and that it was processed unfairly and in a non-transparent manner. He believes that the first defendant unlawfully forwarded his personal data to the second and third defendants. to the defendant, as well as to the notary public and the courts, without informing the plaintiff about this. He believes that this conduct violated numerous provisions of the General Data Protection Regulation. He points out that they violated his right to be forgotten, because they ignored the plaintiff's request to delete his data, and also because they did not accept his objection. He believes that the defendants did not have a valid legal basis for using his data, but that the 1st defendant should have deleted his personal data after the contract was terminated and after it was determined that he had no debt. In addition, the defendants, with their false invoices, certificates and other credible documents, induced the court to use the plaintiff's personal data to access the plaintiff's data in the Ministry of the Interior's records. This conduct of the defendants and their unlawful actions caused the plaintiff both non-material (stress, fear, damage to reputation, violation of privacy, reduction of life activities) and material (costs for legal protection, communication, time spent, potential creditworthiness). In light of all the above, the plaintiff proposes to issue a judgment as under points I. and II. of the operative part. 2. The first defendant states in his response to the lawsuit and in the further course of the proceedings that the lawsuit is unfounded, i.e. inadmissible, that the plaintiff has not proven any unlawful action by A1 Croatia, nor the existence of damage or a causal link between any actions by A1 Croatia and the alleged damage. He believes that it is inadmissible for the court to order one counterparty by judgment to delete "all personal data" of the other counterparty - by that logic, A1 Croatia, according to the finality of the decision in these proceedings, should not have the plaintiff recorded either as a debtor or as a creditor of the obligations from these proceedings. 2.1. Collection proceedings were conducted against the plaintiff due to a recorded debt due to failure to return the terminal equipment after the plaintiff's termination of the contract. The plaintiff's return of the equipment was not properly registered, most likely due to an unintentional human error at the subcontractor Agramservis d.o.o. (whose employee most likely did not enter the appropriate status when returning the equipment). With millions of subscription contracts, it is impossible for such things not to happen sometimes. The plaintiff was issued invoices for the equipment that the plaintiff did not object to. Due to the existing debt in the plaintiff's system, based on undisputed invoices, an extrajudicial collection was first attempted through the 2nd defendant, and then court proceedings were initiated through the 3rd defendant.2.2. The plaintiff's first objection to the disputed invoices from 02/2023 and 03/2023 was received by A1 Croatia only in January 2024 at the request of Hakom, to which A1 Croatia responded to the plaintiff by e-mail on 30.1.2024. The instruction to the 3rd defendant to withdraw the case from the lawsuit and the withdrawal itself were made immediately thereafter.2.3. During these proceedings, no data of the plaintiff that is not otherwise processed in collection proceedings in the Republic of Croatia were processed. Furthermore, each processing was carried out on a lawful basis, and the plaintiff was informed of these processing operations already when concluding the contract. Namely, an integral part of the aforementioned Contract is the General Terms and Conditions of A1 Hrvatska d.o.o., which refer to the Statement on the Protection of Personal Data of A1 Hrvatska d.o.o., and in point 4c of the aforementioned Statement, the plaintiff is warned as follows: If you do not fulfill your contractual obligations, in order to protect ourselves as a creditor, we may forward the relevant personal data and use the services of natural and legal persons for the collection of receivables (e.g. law firms, debt collection agencies, etc.). Before we take such a measure, we will specifically inform you of this via the contact information you provided to us or via the service interface itself, in order to give you the opportunity to comment. The plaintiff was informed that the next step in the collection of open accounts is precisely forwarding the debt to a collection agency or initiating legal proceedings by a warning sent to him on 28.4.2023.2.3. The first defendant further states that the delivery of the plaintiff's data to the second defendant and the third defendant was therefore carried out on a lawful basis, and the plaintiff was informed of the possibility of such processing when concluding the contract.2.4. A1 Croatia has concluded a personal data protection agreement with the second defendant as the processor, whereby A1 Croatia has taken the necessary measures to protect personal data.2.5. The first defendant also points out that the third defendant, as a law firm, is not considered a processor in relation to the personal data of the plaintiff as the counterparty, but rather a third party.2.6. The plaintiff was aware of all his data processed by A1 Croatia, given that this issue is also covered in detail in the Personal Data Protection Statement. In addition, the Personal Data Protection Statement also lists the contact information of the A1 Croatia personal data protection officer (therefore, the plaintiff unfoundedly claims that he was not aware of this contact). Pursuant to point 3 of the Statement, the plaintiff was informed that his data would be retained for at least 12 months after the termination of the contract, and if necessary longer, given that they would not be deleted as long as the debt collection procedure was ongoing, as well as all legal obligations related to that procedure. The plaintiff was informed and warned of all of the above when concluding the contract.2.7. When the 1st defendant received the plaintiff's complaint in January 2024 (via Hakom), A1 undertook the necessary checks, reversed the debt and suspended the proceedings against the plaintiff. Instead of properly filing a complaint against the invoice, the plaintiff decided to initiate the relevant litigation in which he claims that he suffered damage in the amount of as much as 200,000.00 euros.2.8. In the end, the plaintiff could not have suffered any damage in any case, the legally prescribed and permitted debt collection procedures do not constitute an unlawful act - case law has long established this in terms of mental anguish claimed by debtors against whom proceedings were initiated that were ultimately concluded in favor of the debtor. If what the plaintiff is requesting were legally permissible, absolutely every debtor/defendant/enforcer who succeeded in some court proceeding would have the right to compensation for mental anguish, violation of the privacy of personal data, or something else unrelated to the merits.2.9. The plaintiff's data were lawfully processed, the plaintiff was informed about this processing, he was also informed about the possible forwarding of the data to the 2nd defendant and the 3rd defendant, the plaintiff's data could not be "deleted" immediately after the termination of the contract in order to preserve the legitimate interests of A1 Croatia (all of this data was necessary for the procedures at that time, and is still necessary today precisely for this procedure). A1 Croatia, by concluding a contract with the 2nd defendant, the defendant as the processor has taken all reasonable security measures to protect the data of its debtors. Therefore, since there is no unlawful action by A1 Croatia, there is no liability for any damage.2.10. Finally, the first defendant states that it is obvious that the damage described by the plaintiff in terms of "constant stress", "nervousness", "reputational risk" and the like clearly did not occur. Namely, the plaintiff is familiar with the provisions of the Electronic Communications Act and knew at what point he had the right to terminate the Contract, and in addition, he is filing the lawsuit in question himself and is using artificial intelligence to resolve the dispute. Therefore, this is a person who is literate enough not to "fear" that the disputed claim will be forcibly enforced (given the legal remedies he is entitled to file). Also, a debt of around EUR 100.00, according to the first defendant, is not a reason for any great fear, and especially not for "reputational risk". It is illogical that a debt in the stated amount would cause the plaintiff so much fear, insomnia and nervousness, while at the same time the plaintiff independently, apparently without any fear or anxiety, initiates proceedings in which he claims the amount of 200,000.00 euros from as many as three defendants.2.11. Following all of the above, the first defendant proposes to dismiss the claim with reimbursement of the costs of the proceedings.3. The second defendant, in his response to the claim and the further course of the proceedings, disputes the claim and claim in their entirety and proposes to dismiss them without delay. He believes that the plaintiff has not proven in any way that he would suffer any damage. In addition, the plaintiff alleges in the claim, which is completely unfounded, that A1 Croatia would unlawfully provide personal data to the second defendant CEI Zagreb. Namely, CEI Zagreb d.o.o. was, on the basis of the Business Cooperation Agreement, collecting, or acting for the purpose of collecting due receivables from A1 Hrvatska (formerly VIPnet) towards debtors for the first defendant. Therefore, if the plaintiff's personal data was transferred as he claims, it was for the purpose of fulfilling contractual obligations and collecting receivables. After the termination of that contractual relationship, all personal data was deleted.3.1. The plaintiff claims that the debt does not exist, but does not prove this in any way, but rather discusses incoherently the violation of the right to protection of personal data.3.2. Also, the plaintiff completely vaguely and incoherently objects to the business practice of telephone conversations of the second defendant and states that the latter is launching a "campaign of false advertising", and all this is in no way connected with his claim.3.3. In light of all the above, given that this is obviously a frivolous litigation and an unnecessary burden on the Court and all defendants with this completely unfounded litigation, the second defendant proposes that the Court dismiss the lawsuit without further delay as unclear and unsuited for discussion, and alternatively, dismiss the claim.4.The third defendant states in his response to the complaint and in the further course of the proceedings that the claim is inadmissible, i.e. unfounded, and proposes that the complaint be dismissed, i.e. rejected. He further states that the plaintiff did not state a single action of the third defendant himself that would have violated the provisions of the General Data Protection Regulation, nor did he describe any harmful actions of the third defendant. He points out that the lawyer is the data controller exclusively in relation to the personal data of his clients, while in relation to the personal data of all other participants in the proceedings, including the data of the opposing parties such as the plaintiff, the lawyers are considered neither the controller nor the processor, but rather third parties. Therefore, he disputes the passive standing on the basis of compensation for damages for which the controllers or processors of data are liable. He points out that the complaint does not describe any damage, let alone damage in the equivalent value of as much as EUR 150,000.00 or 200,000.00. In relation to the allegations that the third The defendant, who, as the attorney-in-fact of the first defendant, initiated enforcement proceedings "created false and unlawful personal data of the plaintiff", states that the lawyer is obliged to initiate court proceedings at the instruction of his own client, whereby the third defendant did not "create" any personal data of the plaintiff. In addition, the plaintiff's claims that he would have addressed the third defendant hundreds of times are untrue, but the only time the plaintiff directly addressed the third defendant was by e-mail on March 12, 2024, and on that occasion the third defendant referred him to the first defendant as the manager of the processing of the plaintiff's data. 4.1. Given the above and the fact that the third defendant, as a lawyer, acted exclusively on the instructions of the first defendant, it is obvious that the claim against the third defendant is unfounded. Therefore, it is proposed to immediately dismiss the claim against the third defendant by partial judgment with reimbursement of the costs of the proceedings. 3. During the proceedings, the court inspected the proposal for enforcement (pp. 8-13 of the file), the extract from the Ministry of Internal Affairs for the plaintiff (pp. 14 of the file); the submission of February 13, 2024 (pp. 15 of the file), the power of attorney (pp. 16 of the file), an extract from the business books (pp. 17 of the file), e-mail communication (pp. 18-21 and 194 of the file), the notice of termination of the subscription relationship (pp. 25 of the file), payment slips (pp. 26 and 27 of the file), a transcript of messages (pp. 28-48 of the file), the opinion of the Personal Data Protection Agency (pp. 84-86 of the file), the notice of the concluded contract (pp. 92-95 of the file), the General Terms and Conditions of the I. defendant (pp. 96-102 of the file); statement on the protection of personal data (pp. 103-110 of the file), warning (pp. 111 of the file), standard data processing agreement concluded between the I. II. defendant (pp. 113 – 142 of the file), Business Cooperation Agreement between the I. and II. defendants (pp. 153 to 158 of the file) and evidence was presented by hearing the plaintiff.4. Acting in accordance with Art. 8. of the Civil Procedure Act (Official Gazette No.: 53/1991, 91/1992, 112/1999, 88/2001, 117/2003, 88/2005, 2/2007, 84/2008, 96/2008, 123/2008, 57/2011, 25/2013, 28/2013, 89/2014, 70/2019, 80/2022, 114/2022 and 155/2023 - hereinafter: the Civil Procedure Act), and by assessing each piece of evidence separately and all evidence together, based on the results of the entire proceedings, this court has determined that it lacks jurisdiction in relation to part of the claim, while the remaining part of the claim is unfounded.5. Article 51(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – hereinafter the General Regulation) provides that each Member State shall ensure that one or more public authorities are responsible for monitoring the application of this Regulation in order to protect fundamental rights and freedoms and facilitate the free flow of personal data within the Union (supervisory authority).5.1. Article 4(1) of the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/18 – hereinafter the Implementing Act) provides that the supervisory authority, within the meaning of Article 51 of the General Data Protection Regulation, is the Personal Data Protection Agency (hereinafter: the Agency). Article 6, paragraph 1 of the Implementing Act stipulates that the Agency, in addition to the powers established by the Regulation, shall, inter alia, initiate and conduct appropriate proceedings against responsible persons for violations of the General Data Protection Regulation and this Act. Article 34, paragraph 1 of the Implementing Act stipulates that anyone who believes that a right guaranteed by this Act and the General Data Protection Regulation has been violated may submit a request to the Agency for a determination of a violation of rights, whereby the Agency shall decide on the violation of rights by means of a decision (paragraph 2); the Agency's decision is an administrative act (paragraph 3); no appeal is permitted against the Agency's decision, but an administrative dispute may be initiated by means of a lawsuit before the competent administrative court (paragraph 4).6. From all of the above, it follows that this court does not have jurisdiction to decide on the part of the claim relating to the determination that the 1st defendant "without a valid legal basis, after the termination of the subscription contract and the duly returned equipment, unlawfully continued to process, transfer and use the personal data of the plaintiff UPF, thereby violating the provisions of the General Data Protection Regulation (GDPR), in particular Articles 5, 6, 12-21, 30, 33, 34, 82 of the GDPR, as well as recitals 39, 65, 85, 86, 87, 146, 173 of the GDPR"; that the 2nd defendant the defendant "after taking over the data from A1 Hrvatska d.o.o., without a valid legal basis and without prior verification of the facts, unlawfully processed, used, shared and forwarded the personal data of the plaintiff UPF, and took aggressive collection actions and created psychological pressure, thereby violating the provisions of the General Data Protection Regulation (GDPR), in particular Articles 5, 6, 12-21, 30." and that III. the defendant "based on the data received from A1 Hrvatska d.o.o. and/or CEI Zagreb d.o.o., without a valid legal basis, using inaccurate and incomplete data, contrary to the principles and provisions of the General Data Protection Regulation (GDPR), in particular Articles 5, 6, 12-21, 30, 33, 34, 82 of the GDPR, as well as recitals 39, 65, 85, 86, 87, 146, 173 of the GDPR, continued to process, forward, use and use the personal data of the plaintiff UPF in various court and enforcement proceedings, thereby causing material and non-material damage to the plaintiff". The Agency is competent to decide on the aforementioned violations within the meaning of Article 6, paragraph 1 and Article 34 of the Enforcement Act. This court is also not competent to order the defendants to submit to the plaintiff in writing all the data and documentation it possesses and processes about the plaintiff; to order the defendants to delete the said data, to inform the plaintiff in writing of the actions taken, as well as to permanently prohibit them from further processing and forwarding the plaintiff's personal data. Namely, the Agency is also competent to decide on the above regarding the request for the determination of a violation of rights, all within the meaning of Articles 34 to 43 of the Implementation Act.7. Article 16, paragraph 2 of the ZPP stipulates that when the court determines during the proceedings, until the decision becomes final, that the court is not competent to resolve the dispute, but some other domestic body, it shall declare itself incompetent, terminate the actions taken in the proceedings and dismiss the claim. Accordingly, pursuant to Article 16, paragraph 2 of the ZPP, and in connection with Article 4, paragraph 1, Article 6, paragraph 1, Articles 34 to 43 of the Implementation Act, it was decided as under point I of the operative part.8. In these proceedings, it is not disputed that the plaintiff as a user and the 1st defendant as an operator of public electronic and communications networks and services concluded a contract on the establishment of a subscription relationship, which contract was terminated and the plaintiff, upon termination of the contract, returned to the 1st defendant the devices (equipment) that he used under this contract. It is undisputed that the 1st defendant, despite returning the equipment, issued an invoice to the plaintiff for the said equipment. It is also undisputed that the 1st defendant, represented by an attorney, filed a motion for enforcement against the plaintiff with the 3rd defendant for the purpose of forcible collection of the claim in question. It is undisputed that between the 1st and 2nd defendants, the defendant concluded a Business Cooperation Agreement for the provision of services within the framework of the debt collection process.9. It is disputed whether - due to the actions taken by the defendants for the purpose of forced debt collection, namely the processing of personal data, and in connection with this, issuing invoices, contacting the plaintiff by telephone, and initiating enforcement proceedings - the defendant is liable for damage to the plaintiff.10. Article 1045, paragraph 1 of the Civil Obligations Act (Official Gazette, No. 35/05, 41/08, 148/11 - hereinafter the ZOO) stipulates that anyone who causes damage to another is obliged to compensate for it, unless he proves that the damage occurred through no fault of his. Article 1046 of the ZOO stipulates that damage is the reduction of someone's property (ordinary damage), the prevention of its increase (forfeiture of benefits) and the violation of personality rights (non-pecuniary damage).10.1. Article 82, paragraph 1 of the General Regulation stipulates that any person who has suffered material or non-material damage due to a breach of this Regulation shall have the right to compensation from the controller or processor for the damage suffered. 10.2. Article 19, paragraph 1 of the ZOO stipulates that every natural and legal person has the right to the protection of their personality rights under the conditions laid down by law, with paragraph 2 of the same article stipulating that personality rights within the meaning of this Act shall mean the rights to life, physical and mental health, reputation, honour, dignity, name, privacy of personal and family life, freedom, etc. 10.3. Article 1100 of the ZOO stipulates that in the event of a breach of personality rights, if it finds that the gravity of the breach and the circumstances of the case justify it, the court shall award fair financial compensation, regardless of compensation for material damage, and even if there is none (paragraph 1). When deciding on the amount of fair monetary compensation, the court shall take into account the severity and duration of the physical pain, mental suffering and fear caused by the injury, the purpose for which the compensation serves, but also that it does not favour aspirations that are incompatible with its nature and social purpose (paragraph 2).11. The assumptions of liability for damage are: the subjects of the obligatory relationship of liability for damage, the harmful act of the harmdoer, the causal connection and the illegality of the harmful act of the harmdoer. Liability for damage therefore arises under the assumption that the person responsible for the damage committed an unlawful harmful act that caused damage to the person seeking compensation for the damage and if there is a causal connection between the harmful act and the damage as a result.All of the above assumptions must be cumulatively fulfilled, and the burden of proving these assumptions lies with the plaintiff. This means that if only one of the above assumptions is missing, there is no mandatory legal relationship of liability for damage under which the harmdoer is obliged to repair the damage caused to the injured party, and the injured party is entitled to claim compensation for damages.12. The plaintiff stated in his statement that after the termination of the contract and the return of the equipment, they continued to send him invoices to his previous address, where new tenants now live, and they informed him that he had some invoices, or enforcements. After that, the first defendant called him again and offered new services, although the plaintiff said that he did not want them. Such sales calls continue, despite the fact that the plaintiff asked not to contact him and to delete all data. The first defendant then forwarded his personal data to the second defendant, and the second defendant contacted him daily, called him, and sent him messages, even after he told him that he had no debt and that everything had been paid and the equipment had been returned. They did not stop, but sent him hundreds of calls and messages constantly from a new number. After that, he received a writ of execution filed by the 3rd defendant via eGrađan, and he did not understand what kind of writ of execution it was when there was no debt. Then he received a second writ of execution from this court. He did not know what to do anymore and filed the lawsuit in question. He was constantly called in various situations to pay a debt that did not exist and they put pressure on him, for example when he was with family or friends, so he had to be careful when answering the phone so that people would not think he was a criminal. In this way, he was caused material and non-material damage, as he indicated in the submission of May 27, 2025. He suffered damage in the form of lost time to exercise his rights, which he spent talking, writing SMS messages, going to the police. His damage is also that they did not provide him with recordings of conversations that are his property, as well as that they did not update his data and delete his data. He also suffered damage because they called him hundreds of times over the months regarding the debt in question, and each call caused him a feeling of frustration, because they threatened him with foreclosure, eviction from the apartment, and that they would contact his neighbors.12.1. When asked specifically by the 3rd defendant whether the 3rd defendant had contacted him hundreds of times, he replied that he had contacted him via one or two emails. When asked who he had contacted hundreds of times, as he states in the complaint, he replied that the 1st and 2nd defendants had contacted him hundreds of times and that he had informed their contacts in return, or requested his personal information. In that proceeding, 99% of the calls were made by the 2nd defendant. When specifically asked when he visited a doctor or psychologist regarding the mental disorders he had, he replied that he did so in August 2025. When asked why he did not visit a doctor before filing the lawsuit, given that he described the disorders in the lawsuit, he replied that he believed that the harassment would stop.13. In these proceedings, the harmful actions referred to by the plaintiff are the unlawful use of the plaintiff's personal data by the defendant, which were used to issue invoices for the debt in question, the submission of a proposal for enforcement, "hundreds" of telephone calls and messages sent to him by the defendants in order to collect the debt.14. In this regard, it is initially stated that the plaintiff did not submit evidence that a violation of the rights guaranteed by the Implementing Act or the General Data Protection Regulation would have been established in the administrative proceedings before the Agency, so that this would have been an unlawful use of the plaintiff's personal data by the defendant, or that such an action by the defendant would have been unlawful (and therefore the defendant would have been liable for damage). Also, issuing an invoice for the debt in question and submitting a proposal for enforcement do not constitute actions that contain an element of illegality. This is because one of the fundamental rights of every natural and legal person is precisely the right to access to court, prescribed and guaranteed by the Constitution of the Republic of Croatia in the provision of Article 29, which stipulates that everyone has the right to a fair and reasonable time-limit decision on their rights and obligations by an independent and impartial court established by law.14.1. It should be noted that during the proceedings it was established that the plaintiff did not file an objection with the 1st defendant regarding the invoice issued, but that the 1st defendant received the said objection for HAKOM to comment on and, upon receipt thereof, on 30 January 2024, sent an e-mail to the plaintiff informing him that it had been established that the plaintiff had returned the equipment, which is why the outstanding debt was cancelled and the suspension of the lawsuit was requested. By a submission dated 13 February 2024, the first defendant as the enforcement agent submitted a submission through his attorney (here the third defendant) withdrawing the enforcement proposal against the plaintiff as the enforcement debtor.14.2. Furthermore, the plaintiff in the enforcement proceedings initiated against him (and in which the enforcement proposal was withdrawn) is entitled to reimbursement of costs. It is precisely such an obligation of a party to reimburse the other party for the costs of the proceedings in the event of initiating proceedings that are determined to be unfounded, that serves the purpose of deterring the initiation of proceedings for which there is no basis, but there is no prohibition on their initiation, since it would be contrary to the previously cited constitutional principle of the possibility of access to court for every natural and legal person. As a result of the above, the issuance of an invoice by the first defendant and the submission of the enforcement proposal, which was submitted by the third defendant at the order of the first defendant, the defendant as an attorney, represent actions in which there is no illegality, i.e. in the aforementioned part, the prerequisites for damage are not cumulatively met, which is necessary for liability for damage to exist.14.3. In relation to the "hundreds" of calls and messages that the defendants sent to the plaintiff in order to collect the debt in question, it follows from the plaintiff's own statement that the 1st and 2nd defendants contacted him hundreds of times; that is, that in that proceeding 99% of the calls were sent to him by the 2nd defendant, and that the 3rd defendant contacted him via one or two emails.14.4. It follows from the above that the numerous messages and calls that the plaintiff mentions were sent to him by the 2nd defendant, which also follows from the messages attached to the file on pages 28 to 48 of the file. Regarding such calls, the plaintiff stated that they caused him a feeling of frustration, because they threatened him with foreclosure, eviction from the apartment, and that they would contact his neighbors. In addition, he states that they constantly called him in various situations to pay a debt that does not exist and they put pressure on him, for example when he was with family or friends, so he had to be careful when the phone answered so that people would not think he was a criminal. In this way, the plaintiff points to the occurrence of non-pecuniary damage from the violation of personality rights under Article 19, paragraphs 1 and 2 of the ZOO.14.5. During the proceedings, it was established that the 2nd defendant concluded a Business Cooperation Agreement with the 1st defendant (pp. 153-158 of the file) by which the 2nd defendant undertakes to provide the services specified in the Agreement within the process of collecting claims from the 1st defendant's users, with the primary task being to collect the claims at once in the total amount of the debt. Within the framework of the above, the 2nd defendant did indeed contact the plaintiff several times in order to collect the debt in question, which is evident from the large number of messages he sent to the plaintiff, as well as from the plaintiff's statement. It is unclear to the court how such actions would have violated the reputation and privacy of the plaintiff, because the plaintiff does not even explain the above, but it can be accepted that the plaintiff experienced a subjective feeling of fear, frustration, stress, or a feeling of need to be careful in case he was contacted by phone while he was with his family and friends.14.6. However, a violation of the injured party's personality rights does not immediately and unconditionally mean the injured party's right to payment of monetary compensation, but this right will accrue to the injured party only if the severity of the violation of the personality rights and the circumstances of the case justify it. In the specific case, the plaintiff proposed that evidence be provided through a medical expert examination by an expert psychiatrist, but in this regard he did not submit appropriate medical documentation. The plaintiff stated in his statement that he was not with the doctor at the time when the actions were taken due to which the plaintiff claims that he suffered damage, or that he did not seek help for his ailments in that sense, but claims that he went to the doctor in August 2025 (the hearing in the proceedings in question was held on 26 August 2025). Since no documentation was submitted in the file on the basis of which a medical expert opinion would be conducted, the court rejected this evidence from the plaintiff.14.7. In relation to the reduction in life activities that he claims to have experienced, it should be noted that the plaintiff does not in any way state what it consists of, what restrictions the plaintiff's life activities are, and does not submit any evidence in that regard. Therefore, and since the plaintiff did not prove that he would suffer such damage due to the "hundreds" of calls and messages that would justify the award of compensation by their intensity and duration, the court assessed his claim in the aforementioned part as unfounded.14.8. In relation to the material damage that the plaintiff claims to have incurred (submission of 27 May 2025), it should be noted that he has not in any way proven what costs he incurred for "legal protection" (nor has he submitted any invoices or other evidence in this regard), while "communication and time spent" do not constitute damage within the meaning of Article 1046 of the ZOO. As for the "potential creditworthiness", it is obvious that the aforementioned damage did not occur for the plaintiff, i.e. it is not an actual damage, but the plaintiff believes that it could have possibly occurred. Taking into account the above, since the plaintiff has not proven that any material damage would have occurred to him in particular, his claim was also assessed as unfounded in this part.14.9. As it was determined that the prerequisites for damage were not cumulatively met, which means that the defendant is not liable for damages, the plaintiff's request that the defendants jointly compensate him for damages in the amount of EUR 200,000.00, as well as to issue him an apology for the above, was rejected, and it was decided as under point II.of the ruling.15. Bearing in mind the principle of procedural economy, i.e., with an effort to conduct the procedure with as few costs as possible for the parties to the procedure in accordance with the provision of Article 10, paragraph 1 of the Civil Procedure Code, the court rejected all remaining evidentiary proposals of the plaintiff, which evidentiary proposals were not necessary for the adjudication of this legal matter for the reasons stated above.16. Since the plaintiff lost the lawsuit in its entirety, he is obliged to compensate the defendants for the costs of the procedure in accordance with Article 154, paragraph 1 of the Civil Procedure Code and by applying the provisions of the Tariff on Fees and Compensation of Costs for the Work of Attorneys (Official Gazette 153/23 – hereinafter referred to as the Tariff) taking into account the established value of the subject matter of the dispute in the amount of EUR 200,000.00 (i.e. the amount of compensation for damage claimed by the plaintiff in these proceedings).16.1. The first defendant was awarded representation costs through an attorney-at-law, namely for the preparation of the response to the lawsuit 1505 points (Tbr. 8/1 OT), for the preparation of the submission of 1 July 2025 1505 points (Tbr. 8/1 OT) and for representation at the hearing on 26 August 2025 1505 points (Tbr. 9/1 OT), or 9,030.00 euros.16.2. II. The defendant was awarded the costs of representation by proxy, within the limits of the requested amount, namely for the response to the lawsuit 3,009.61 euros, for the preparation of the submission of 16 July 2025 3,009.61 euros and for representation at the hearing on 26 August 2025 3,009.61 euros, a total of 9,028.83 euros with the corresponding value added tax of 2,257.21 euros, a total of 11,286.04 euros. 16.3. III. The defendant was awarded representation costs through an attorney for the preparation of the response to the lawsuit 1505 points (Tbr. 8/1 OT) and for the preparation of the submission of July 4, 2025 1505 points (Tbr. 8/1 OT), a total of 6,020.00 euros, which, with the corresponding VAT of 1,505.00 euros, amounts to 7,525.00 euros.16.4. Accordingly, it was decided as under points III., IV. and V. of the ruling. In Zagreb, October 10, 2025. Judge: Marina Nikolić Information on legal remedies: An appeal against this judgment is allowed to the County Court. The appeal shall be submitted through this court, in four identical copies, within 15 days from the date of delivery of the transcript of this judgment. DNA: 1. Plaintiff 2. I. Defendant in full. 3. II. Defendant in full. 4. to the third defendant in full.
