AZOP (Croatia) - Decision 16-02-2023

AZOP - Decision 16-02-2023
Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 5 GDPR Article 6 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	16.02.2023
Published:	04.12.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	Decision 16-02-2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Croatian
Original Source:	AZOP (in HR) (in HR)
Initial Contributor:	leeve

The DPA ruled that publishing coowners' personal data on a notice board requires a lawful basis under Article 6 GDPR. Doing so without one violates privacy by making it publicly available to non-owners.

English Summary

Facts

The DPA received a complaint regarding a violation of the protection of personal data of X (the data subject). The data subject states that the representative of the coowners of an apartment building in which he lives, made publicly available on a notice board the Decision on linking the land register and the register of concluded contracts for building X, which, among other things, contains his personal data.

Upon receiving such a complaint, the AZOP launched a formal investigation.

In the entire procedure conducted in this administrative matter, it was established that the representative of the co-owners of the residential building posted a Decision on the notice board, which included personal data of the applicant, such as name, surname, and land register details related to property ownership. The decision was made available to anyone, including non-residents, violating privacy by publicly sharing personal data.

Holding

The DPA found multiple breaches of GDPR.

The DPA held that the publication of coowners' personal data on a notice board violates their privacy under the GDPR, as it lacked a legal basis under Articles 5 and 6. The coowners' representative should have used alternative methods, such as meetings or mailed notices, to inform co-owners without publicly disclosing personal data.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

REPUBLIC OF CROATIA
PERSONAL DATA PROTECTION AGENCY

CLASS:

REGULATION NUMBER:
Zagreb, 16 February 2023

Personal Data Protection Agency pursuant to Article 57(1) and 58(1)

of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) OJ L119, Article 34 of the Act on the Implementation of the General Data Protection Regulation (Official Gazette, No. 42/18) and Articles 41 and 96 of the Act on General Administrative Procedure (Official Gazette, No. 47/09 and 110/21), in connection with a request for the determination of a violation of the right to the protection of personal data X makes the following

DECISION

1. The request for the determination of the violation of the right to protection of personal X is founded.

2. It is determined that Y, as a representative of the co-owners of the residential building X, X, X, X, X, X, X and X
made available on the notice board the Decision on the connection of land registers and the register of concluded contracts for the building in X, which, among other things, contains the personal data of the applicant
X, which action resulted in the processing of personal X contrary to Articles 5 and 6 of the General
Regulation on Data Protection.

R e a n c e s 

The Personal Data Protection Agency (hereinafter referred to as: the Agency) received a request for

establishing a violation of the right to protection of personal data of the applicant X (hereinafter referred to as: the applicant) in which she essentially states that the representative of the co-owner of the residential building in which she lives made available on the notice board the Decision on linking

the land register and the register of concluded contracts for building X, which, among other things, contains

her personal data (name and surname, OIB, description of the Xth floor owned by her, and information on the encumbrance/registration of the lien/housing loan agreement).

1 Along with her Request for establishing a violation of the right to protection of personal data,
the applicant attached a photograph of the Decision on linking the land register and the register of concluded contracts for the building in X, which was located on the notice board of the residential building.

The request is well-founded.

Acting upon the request received, the Agency, within the scope of its powers, by letter,
CLASS: X, REGISTRATION NUMBER: X requested a statement from the representative of the co-owner of the residential building Y
regarding the allegations from the request for determination of a violation of the right to protection of personal data
of the applicant, and in particular on the purpose and legal basis for the availability of the Decision on linking
the land registers and the register of concluded contracts for the building in X, which contains the personal data of the applicant, on the notice board of the residential building.

In his statement submitted to the Agency, the representative of the co-owner of the residential building X,
X, X, X, X, X, X and X, Y states that the Decision on

linking the land registers and the register of concluded contracts for the building in X was located on the notice board of the entrance X, which was removed
after the hearing held on 29 November 2022. In this regard, the co-owner's representative states that he acted in accordance with the instructions of the building manager and, along with his statement, submitted a submission from company X in which he states to the co-owner's representative that he is delivering the decision in question to him so that it can be posted on the building's noticeboard, for the purpose of filing any objections by the co-owner of the building in question with the Municipal Civil Court in X, which issued the decision in question. In addition to the above, we would like to point out that since 25 May 2018, in all Member States of the European Union, including the Republic of Croatia, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) OJ EU L119, has been directly and bindingly applied in all Member States of the European Union, including the Republic of Croatia, in the area of personal data protection. Article 4(1)(1) of the General Data Protection Regulation stipulates that personal data

are all data relating to an identified or identifiable natural person, and an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data must be processed lawfully, fairly and transparently in relation to the data subject; collected for specified, explicit and legitimate purposes; adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (principle of data minimisation);

accurate and, where necessary, kept up to date; kept in a form which permits identification of the data subject only for as long as is necessary for the purposes for which the personal data are processed; processed in a manner that ensures appropriate security of personal data, including protection against

unauthorized or unlawful processing and against accidental loss, destruction or damage by applying
appropriate technical or organizational measures (Article 5 of the General Data Protection Regulation).

Article 6(1) of the General Data Protection Regulation provides that processing is lawful only if and to the extent that at least one of the following is met: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes, (b) the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, (c) the processing is necessary for compliance with a legal obligation to which the controller is subject, (d) the processing is necessary to protect the vital interests of the data subject or of another natural person, (e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, (f) the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. Therefore, we emphasize that for any processing of personal data, there must be a legitimate purpose and a legal basis from Articles 5 and 6 of the General Data Protection Regulation.

In the overall procedure carried out in this administrative matter, it was determined that the representative of the co-owners of the residential building X, X, X, X, X, X, X and X made available on the notice board the Decision on linking the land registers and the register of concluded contracts for the building in X, which,

among other things, contains the personal data of the applicant, which, in addition to the name and surname, also contains other personal data of the applicant that are entered in the land registers and are related to the ownership of the real estate.

In this regard, we state that the personal data of the co-owners can be published on the notice board of the residential building only if there is a legal basis for this from Article 6 of the General Data Protection Regulation. Namely, the public publication of personal data on a notice board violates the privacy of co-owners, since such data becomes accessible to other persons (visitors) who are not tenants of the residential building.

Therefore, taking into account the above, in this case, the existence of a legitimate purpose and legal basis under Articles 5 and 6 of the General Data Protection Regulation for the publication of the personal data of the applicant as a co-owner of the residential building in question on the notice board has not been established.

Accordingly, in this case, the representative of the co-owner could have informed the applicant,

as well as the other co-owners of the residential building, about the adopted Decision on the linking of the land register and the register of concluded contracts for the building in X, for example by publishing it at a joint meeting of the co-owners of the building or by delivering the notification/decision to mailboxes, or in another appropriate manner, all for the purpose of protecting the personal data of the co-owners of the residential building from public availability.

3 In conclusion, and given that the applicant's personal data, according to the representatives of the co-owners of the apartment building in question, are no longer available on the notice board, there is no basis for imposing additional measures provided for by the General Data Protection Regulation.

Therefore, based on all of the above, it was appropriate to proceed as in the operative part of the decision.

INSTRUCTIONS ON LEGAL REMEDY:

An appeal against this decision is not permitted, but an administrative dispute may be initiated by filing a lawsuit
before the Administrative Court in X within 30 days from the date of delivery of this decision.

DEPUTY DIRECTOR

Igor Vulje

Submit:

1. X
2. Y
3. Filing, here.

4