AZOP (Croatia) - Decision 02-07-2025 (Croatian Insurance Bureau case)

AZOP - Decision 02-07-2025 (Croatian Insurance Bureau case)
Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 5(1)(e) GDPR Article 32(2) GDPR Article 32(4) GDPR članak 44 Zakon o provedbi Opće uredbe o zaštiti podataka
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:	02.07.2025
Fine:	101,000 EUR
Parties:	HRVATSKI URED ZA OSIGURANJE (HUO, Croatian Insurance Bureau )
National Case Number/Name:	Decision 02-07-2025 (Croatian Insurance Bureau case)
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Croatian
Original Source:	AZOP (in HR)
Initial Contributor:	ap

The DPA carried out an ex officio investigation based on an anonymous report of a data breach regarding over one million vehicle users, and fined the Croatian Insurance Bureau €101,000 for failing to implement appropriate security measures.

English Summary

Facts

The DPA received an anonymous report regarding a data breach regarding over one million vehicle owners from the Croatian vehicle register. The DPA investigated several organisations associated with the incident, such as the Croatian Insurance Bureau (HUO), Vehicle Centre and the Ministry of the Interior.

During its investigations, the DPA found that the data submitted through the anonymous report coincided with that of the HUO database. This allowed the DPA to establish HUO as the controller. The data included personal information of the owner of the vehicle (e.g. name and address), data on the vehicle (e.g. registration number), and insurance data (e.g. policy number, date of validity).

Holding

The DPA found a violation of Article 32(2) GDPR and 32(4) GDPR, as the controller did not implement appropriate organisational and technical measures to protect the personal data of data subjects. This made it easier for unauthorised persons to access the data.

The DPA also found that the controller did not establish a limit to the retention periods of personal data in their database, in violation of Article 5(1)(e) GDPR.

The DPA fined the controller €101,000. In assessing the fine, the DPA took into account national data protection law (Article 44 of the Act on the Implementation of the General Data Protection Regulation). This article states that if the fine is against a legal person with public authority or performing a public service, the imposed fine must not jeopardise the performance of the public authority or service.

Comment

This summary is based on a press release of the DPA. The Croatian Ministry of Interior is also investigating the data breach.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

Eight administrative fines imposed in the total amount of 350,500.00 euros

July 2, 2025
The Personal Data Protection Agency has imposed eight new administrative fines in the total amount of 350,500.00 euros for violating the provisions of the General Data Protection Regulation and the Act on the Implementation of the General Data Protection Regulation. Below we highlight the two highest administrative fines:
 
Croatian Insurance Bureau administrative fine in the amount of 101,000 euros
Following an anonymous report that the personal data of more than a million vehicle owners from the Register of Registered Vehicles in the Republic of Croatia had been "leaked", the Personal Data Protection Agency conducted supervisory procedures with several personal data controllers - the Croatian Insurance Bureau, the Croatian Vehicle Center, the Ministry of the Interior of the Republic of Croatia, as well as other legal entities that were associated with the incident.
It was determined that the structure of the data submitted to the Agency on the USB stick – data on the vehicle owner (name and surname, date of birth, OIB, JMBG, address of residence), vehicle data (vehicle type, license plate, chassis number) and insurance data (insurance name, policy number and validity date) and data on insurance reductions (bonuses/malus), matches the database of the Croatian Insurance Office and that it is the same controller of personal data processing.
The Agency determined that HUO, as the controller, did not take appropriate organizational and technical measures to protect the personal data of the respondents, which is contrary to the provisions of Article 32, paragraph 2 and paragraph 4 of the General Data Protection Regulation. Due to the failure to take appropriate protection measures, the security of the security system with the personal data of the respondents was compromised, which enabled easier access to the personal data of the respondents by unauthorized persons. It was also determined that HUO did not separately prescribe maximum retention periods for personal data of respondents contained in the Data Register of the Information Centre, which is contrary to the provisions of Article 5, paragraph 1, item (e) of the General Data Protection Regulation.
The aforementioned violations consequently contributed to the possibility of personal data being removed from the HUO database, and the circumstances of this event are also being investigated by the Ministry of the Interior.
Given that HUO is a legal entity with public authority, Article 44 of the Act on the Implementation of the General Data Protection Regulation applies, which stipulates that if an administrative fine is imposed against a legal entity with public authority or against a legal entity performing a public service, the imposed administrative fine must not jeopardize the performance of such public authority or public service, therefore a fine of EUR 101,000 was imposed.

Sports betting company fined in the amount of 175,000 euros
For failing to take technical measures to protect personal data and improperly storing users' personal data, the controller, i.e. the sports betting company, was fined in the amount of 175,000 euros.
The Agency received a report that the sports betting company, in order to verify the user's account on the website, requires users to send a copy of their ID card via e-mail, which does not allow for a secure way of sending documents for verification, which is why the Agency initiated proceedings ex officio due to a high risk to the rights and freedoms of the respondents (players, service users).
It was determined that the controller processed the personal data of its users (name and surname, date of birth, OIB, place of issue of the ID card, address or place of residence, date of issue and until when the ID card is valid, ID card number, and when the user requests their first withdrawal for the purpose of identifying the person and a copy of the ID card) without taking appropriate technical protection measures considering the risks. Among other things, some employees of the controller use passwords that are not strong enough, or passwords that are only 3 characters long, which is not a sufficient protection measure, given that the computers of certain employees can access an e-mail address that contains e-mails with personal data and copies of ID cards of a large number of users. It was also found that employees connect to the administrator part of the betting platform program via an insecure HTTP connection.[*]
Furthermore, the controller did not ensure the deletion of the personal data of the respondents after the expiry of the period for which they must be stored. Namely, the controller was obliged to ensure that the collected personal data were stored in a form that allows the identification of the respondents only to the extent necessary for the purposes for which the personal data are processed, and acted in violation of Article 5(1)(e) of the General Data Protection Regulation.
It was also found that the controller knowingly did not make a backup copy of the data, citing the excessive cost of establishing such a security measure to protect personal data. However, considering that at the time of the inspection, the controller was processing the personal data of 70,259 users of the online betting service, it was obliged to ensure the backup of personal data.
Finally, the Agency imposed six more administrative fines on controllers for violating the General Data Protection Regulation and the Act Implementing the General Data Protection Regulation, ranging from EUR 2,500 to EUR 35,000.
[*] The main difference between HTTP and HTTPS is in the way data is transmitted. While HTTP sends data as plain text, without any protection, HTTPS sends it encrypted, making it secure and difficult for unauthorized persons to access.