View source for AZOP (Croatia) - Decision 08-03-2022 (energy company)

{{DPAdecisionBOX

|Jurisdiction=Croatia
|DPA-BG-Color=
|DPAlogo=LogoHR.png
|DPA_Abbrevation=AZOP (Croatia)
|DPA_With_Country=AZOP (Croatia)

|Case_Number_Name=Unknown energy company 
|ECLI=CRO

|Original_Source_Name_1=AZOP
|Original_Source_Link_1=https://azop.hr/izrecene-upravne-novcane-kazne-u-ukupnom-iznosu-od-1-6-milijuna-kuna/
|Original_Source_Language_1=Croatian
|Original_Source_Language__Code_1=HR

|Type=Complaint
|Outcome=Upheld
|Date_Started=
|Date_Decided=
|Date_Published=08.03.2022
|Year=
|Fine=940000
|Currency=HRK

|GDPR_Article_1=Article 15(3) GDPR
|GDPR_Article_Link_1=Article 15 GDPR#3



|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=

|Initial_Contributor=Presido Croatia
|
}}

Croatian DPA issued a fine in the amount of HRK 940 000 (120 000 €) on the unknown company for failure to submit video surveillance recordings (copies of personal data) at the request of data subject (violation of the GDPR Article 15 (3)).

== English Summary ==

=== Facts ===
The Agency received a request to determine a violation of the right of protection of personal data from the data subject who requested from the Company to submit video surveillance recordings of the data subject. Data subject used the services of a petrol station at one of the Company's branches and, due to dissatisfaction with the measurement of refueling, filed a complaint in accordance with consumer protection regulations. After that, in order to better protect his consumer rights, he requested the delivery of copies of his personal data via a copy of the video surveillance recordings, specifying the date and time of the event. The Company rejected his request on the grounds that there was no written request from the authorities to provide a copy of the recording, that the purpose of the request was not justified and that obtaining such a copy would adversely affect the rights and freedoms of gas station employees and customers who where there at that moment. In his letter to the Company, the data subject warned them of the possibility of contacting the Agency in case of violation of his right of access.




=== Holding ===
The Agency, at the prior request of the data subject, gave a general opinion on the obligation of the Company to provide data subject with copies of the requested video surveillance recording, but the Company replied that they could not provide the requested recording due to fact they destroy recordings after seven days.
The Ageny stated that the right of access was violated, i.e. to obtain a copy of the data subject's personal data, as one of the fundamental rights, by denying him the right to obtain a copy of the video surveillance recording. 
In this matter, not only indirect material damage to the data subject was established, but also the possible financial benefit for the Company. Company, by not submitting the recording and by subsequent deletion after seven days indirectly avoided financial damage it could suffer due to consumer dispute with the data subject and, by not submitting the recording, eliminated possibly important evidence in a special proceeding. 
The Agency is not authorized to determine whether the damage actually occurred and its amount, but if the damage was due to violation of the General Data Protection Regulation or if there is such a possibility, then the Agency should take this fact into account when assessing the amount of administrative fines.


== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

<pre>
The Agency for Personal Data Protection imposed an administrative fine in the amount of HRK 940,000.00 on the head of processing or the company in the energy sector (hereinafter: the Company) for failure to submit video surveillance camera footage (copies of personal data) at the request of respondents. infringements of Article 15 (3) of the General Data Protection Regulation.

The Agency received a request for a violation of the right to protection of personal data from the respondent who requested the Company to submit video surveillance camera footage of the applicant (respondent). Namely, the applicant used the services of a petrol station at one of the Company's branches and, due to dissatisfaction with the measurement of refueling, filed a complaint in accordance with consumer protection regulations. After that, in order to better protect his consumer rights, he requested the delivery of copies of his personal data via a copy of the video surveillance camera footage, specifying the date and time. The Company rejected such a request on the grounds that it considered that there was no written request from the competent authorities to provide a copy of the recording, that the purpose of the request was not justified and that obtaining such a copy would adversely affect the rights and freedoms of gas station employees and customers. at that moment. In his address to the Company, the applicant warned of the possibility of contacting the Agency in case of violation of his rights to personal data protection.

After the Agency, at the prior request of the applicant, gave a general opinion on the obligation of the head of personal data processing to provide respondents with copies of the requested video surveillance footage, the Company replied that the applicant could not provide the requested footage due to archives. the site clears after seven days.

In the present case, the right to access personal data was violated, ie to obtain a copy of the applicant's personal data, as one of the fundamental rights of the respondent, by denying him the right to obtain a copy of the video surveillance camera footage of the applicant. the General Regulation on Data Protection prescribes the imposition of administrative fines in accordance with Article 83, paragraph 5, item b), or administrative fines in the amount of up to EUR 20,000,000 or in the case of entrepreneurs up to 4% of the total annual worldwide turnover for the previous financial year, whichever is greater.

In this administrative matter, not only indirect material damage to the applicant was established, but also the possible financial benefit of the Company, which by not submitting the recording and its subsequent deletion after seven days indirectly avoided financial damage it could suffer due to consumer dispute with the applicant. , and by not submitting the recording it eliminated possibly important evidence in a special proceeding. We emphasize that the Agency is not authorized to determine whether the damage actually occurred and its amount, but if the damage was due to violation of the General Data Protection Regulation or if there is such a possibility, then the Agency should take this fact into account when assessing the amount of administrative fines. .

</pre>