AZOP (Croatia) - Decision 02-07-2025 (sports betting agency case)

AZOP - Decision 02-07-2025
Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 5(1) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	20.03.2025
Published:	02.07.2025
Fine:	175,000 EUR
Parties:	n/a
National Case Number/Name:	Decision 02-07-2025
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Croatian
Original Source:	AZOP (in HR)
Initial Contributor:	ap

Following an ex officio investigation, the DPA fined a sports betting agency €175,000 for failing to implement technical measures to secure personal data and improperly storing personal data of users.

English Summary

Facts

A sports betting agency (the controller) verified users by requesting them to send a copy of their ID by e-mail. The DPA began an ex officio investigation after receiving a report on this, as it posed a high risk to the rights and freedoms of data subjects.

The DPA found that the controller processed a wide range of personal data from the identity cards, including name, date of birth, address of residence and ID numbers. This was processed without sufficient technical and organizational measures in relation to the risk; for example, some employees used weak passwords that were three characters long. The program was also merged with an unsafe HTTP connection, which does not encrypt the data. Finally, the controller did not ensure the data was erased once the storage limit had passed.

Holding

The DPA found violations of Article 5(1) GDPR. The DPA considered that the measures set by the controller were insufficient to ensure secure processing (Article 5(1)(f) GDPR). The controller did not allow the users to send documents in a safe manner. Furthermore, the controller processed data from a large number of users (over 70,000), with insufficient safety measures carried out by its employees.

The controller also violated the principle of storage limitation (Article 5(1)(e) GDPR). According to the DPA, the controller had the obligation to ensure the data is kept in a form which permits the identification of users for no longer than necessary.

The DPA fined the controller €175,000.

Comment

This summary is based on a press release of the DPA. The full decision can be accessed here.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

Eight administrative fines imposed in the total amount of 350,500.00 euros

July 2, 2025
The Personal Data Protection Agency has imposed eight new administrative fines in the total amount of 350,500.00 euros for violating the provisions of the General Data Protection Regulation and the Act on the Implementation of the General Data Protection Regulation. Below we highlight the two highest administrative fines:
 
Croatian Insurance Bureau administrative fine in the amount of 101,000 euros
Following an anonymous report that the personal data of more than a million vehicle owners from the Register of Registered Vehicles in the Republic of Croatia had been "leaked", the Personal Data Protection Agency conducted supervisory procedures with several personal data controllers - the Croatian Insurance Bureau, the Croatian Vehicle Center, the Ministry of the Interior of the Republic of Croatia, as well as other legal entities that were associated with the incident.
It was determined that the structure of the data submitted to the Agency on the USB stick – data on the vehicle owner (name and surname, date of birth, OIB, JMBG, address of residence), vehicle data (vehicle type, license plate, chassis number) and insurance data (insurance name, policy number and validity date) and data on insurance reductions (bonuses/malus), matches the database of the Croatian Insurance Office and that it is the same controller of personal data processing.
The Agency determined that HUO, as the controller, did not take appropriate organizational and technical measures to protect the personal data of the respondents, which is contrary to the provisions of Article 32, paragraph 2 and paragraph 4 of the General Data Protection Regulation. Due to the failure to take appropriate protection measures, the security of the security system with the personal data of the respondents was compromised, which enabled easier access to the personal data of the respondents by unauthorized persons. It was also determined that HUO did not separately prescribe maximum retention periods for personal data of respondents contained in the Data Register of the Information Centre, which is contrary to the provisions of Article 5, paragraph 1, item (e) of the General Data Protection Regulation.
The aforementioned violations consequently contributed to the possibility of personal data being removed from the HUO database, and the circumstances of this event are also being investigated by the Ministry of the Interior.
Given that HUO is a legal entity with public authority, Article 44 of the Act on the Implementation of the General Data Protection Regulation applies, which stipulates that if an administrative fine is imposed against a legal entity with public authority or against a legal entity performing a public service, the imposed administrative fine must not jeopardize the performance of such public authority or public service, therefore a fine of EUR 101,000 was imposed.

Sports betting company fined in the amount of 175,000 euros
For failing to take technical measures to protect personal data and improperly storing users' personal data, the controller, i.e. the sports betting company, was fined in the amount of 175,000 euros.
The Agency received a report that the sports betting company, in order to verify the user's account on the website, requires users to send a copy of their ID card via e-mail, which does not allow for a secure way of sending documents for verification, which is why the Agency initiated proceedings ex officio due to a high risk to the rights and freedoms of the respondents (players, service users).
It was determined that the controller processed the personal data of its users (name and surname, date of birth, OIB, place of issue of the ID card, address or place of residence, date of issue and until when the ID card is valid, ID card number, and when the user requests their first withdrawal for the purpose of identifying the person and a copy of the ID card) without taking appropriate technical protection measures considering the risks. Among other things, some employees of the controller use passwords that are not strong enough, or passwords that are only 3 characters long, which is not a sufficient protection measure, given that the computers of certain employees can access an e-mail address that contains e-mails with personal data and copies of ID cards of a large number of users. It was also found that employees connect to the administrator part of the betting platform program via an insecure HTTP connection.[*]
Furthermore, the controller did not ensure the deletion of the personal data of the respondents after the expiry of the period for which they must be stored. Namely, the controller was obliged to ensure that the collected personal data were stored in a form that allows the identification of the respondents only to the extent necessary for the purposes for which the personal data are processed, and acted in violation of Article 5(1)(e) of the General Data Protection Regulation.
It was also found that the controller knowingly did not make a backup copy of the data, citing the excessive cost of establishing such a security measure to protect personal data. However, considering that at the time of the inspection, the controller was processing the personal data of 70,259 users of the online betting service, it was obliged to ensure the backup of personal data.
Finally, the Agency imposed six more administrative fines on controllers for violating the General Data Protection Regulation and the Act Implementing the General Data Protection Regulation, ranging from EUR 2,500 to EUR 35,000.
[*] The main difference between HTTP and HTTPS is in the way data is transmitted. While HTTP sends data as plain text, without any protection, HTTPS sends it encrypted, making it secure and difficult for unauthorized persons to access.