AZOP (Croatia) - Decision 08-03-2022 (energy company)

AZOP (Croatia) - Decision 08-03-2022 (energy company)
Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 15(3) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	08.03.2022
Fine:	940000 HRK
Parties:	n/a
National Case Number/Name:	Decision 08-03-2022 (energy company)
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Croatian
Original Source:	AZOP (in HR)
Initial Contributor:	Presido Croatia

The Croatian DPA (AZOP) imposed a fine of approximately €120,000 against an energy company for a violation of Article 15(3) GDPR by failing to provide the video surveillance recordings requested by the data subject.

English Summary

Facts

The controller is a company that manages gas stations. The data subject tried to refuel at one of the controller's gas stations and was dissatisfied with the measurement of the refuelling. Consequently, he wanted to exercise consumer protection rights. In this exercise, he requested a copy of the gas station's video surveillance recordings, specifying the date and time of the event. The controller, however, rejected the request on the grounds that there was no written request from the authorities to provide a copy of the recording, that the purpose of the request was not justified, and that obtaining such a copy would adversely affect the rights and freedoms of gas station employees and customers who were there at that moment.

The data subject then asked for the DPA's opinion on the matter (and did not yet file a complaint). The DPA published an opinion which stated that the controller had to provide the data subject with copies of the requested video surveillance recording. However, the controller replied to the data subject that they could not provide the requested recording due to fact that they had already destroyed the recordings.

The data subject then filed a complaint with the DPA for a violation of Article 15(3) GDPR.

Holding

The DPA upheld the complaint.

The DPA found that the controller violated Article 15(3) GDPR, by denying him the right to obtain a copy of the video surveillance recording. Hence, the controller decided to impose a fine on the controller. Regarding the height of the fine, the DPA considered that the controller gained a financial benefit from the violation, since it avoided the financial damage it might have suffered as a result of the consumer dispute with the data subject. The DPA emphasised that it cannot determine whether the data subject is entitled to compensation for damages in his consumer protection dispute. However, the DPA decided to impose a of HRK 940,000 (approx. €120,000), for the violation of Article 15(3) GDPR.

Comment

Due to the limited legal reasoning in the decision, it is difficult to explain as to why the DPA came to a particular conclusion. For example, the DPA did not discuss the arguments brought forward by the controller.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

The Agency for Personal Data Protection imposed an administrative fine in the amount of HRK 940,000.00 on the head of processing or the company in the energy sector (hereinafter: the Company) for failure to submit video surveillance camera footage (copies of personal data) at the request of respondents. infringements of Article 15 (3) of the General Data Protection Regulation.

The Agency received a request for a violation of the right to protection of personal data from the respondent who requested the Company to submit video surveillance camera footage of the applicant (respondent). Namely, the applicant used the services of a petrol station at one of the Company's branches and, due to dissatisfaction with the measurement of refueling, filed a complaint in accordance with consumer protection regulations. After that, in order to better protect his consumer rights, he requested the delivery of copies of his personal data via a copy of the video surveillance camera footage, specifying the date and time. The Company rejected such a request on the grounds that it considered that there was no written request from the competent authorities to provide a copy of the recording, that the purpose of the request was not justified and that obtaining such a copy would adversely affect the rights and freedoms of gas station employees and customers. at that moment. In his address to the Company, the applicant warned of the possibility of contacting the Agency in case of violation of his rights to personal data protection.

After the Agency, at the prior request of the applicant, gave a general opinion on the obligation of the head of personal data processing to provide respondents with copies of the requested video surveillance footage, the Company replied that the applicant could not provide the requested footage due to archives. the site clears after seven days.

In the present case, the right to access personal data was violated, ie to obtain a copy of the applicant's personal data, as one of the fundamental rights of the respondent, by denying him the right to obtain a copy of the video surveillance camera footage of the applicant. the General Regulation on Data Protection prescribes the imposition of administrative fines in accordance with Article 83, paragraph 5, item b), or administrative fines in the amount of up to EUR 20,000,000 or in the case of entrepreneurs up to 4% of the total annual worldwide turnover for the previous financial year, whichever is greater.

In this administrative matter, not only indirect material damage to the applicant was established, but also the possible financial benefit of the Company, which by not submitting the recording and its subsequent deletion after seven days indirectly avoided financial damage it could suffer due to consumer dispute with the applicant. , and by not submitting the recording it eliminated possibly important evidence in a special proceeding. We emphasize that the Agency is not authorized to determine whether the damage actually occurred and its amount, but if the damage was due to violation of the General Data Protection Regulation or if there is such a possibility, then the Agency should take this fact into account when assessing the amount of administrative fines. .