AZOP (Croatia) - Decision 18-12-2020: Difference between revisions

From GDPRhub
No edit summary
No edit summary
 
(5 intermediate revisions by 2 users not shown)
Line 7: Line 7:
|DPA_With_Country=AZOP (Croatia)
|DPA_With_Country=AZOP (Croatia)


|Case_Number_Name=Decision of 18 December 2020
|Case_Number_Name=Decision 18-12-2020
|ECLI=
|ECLI=


|Original_Source_Name_1=AZOP
|Original_Source_Name_1=AZOP
|Original_Source_Link_1=https://azop.hr/wp-content/uploads/2023/08/Objava-i-brisanje-fotografije-policijskog-sluzbenika-R11.pdf
|Original_Source_Link_1=https://azop.hr/wp-content/uploads/2023/10/Objava-osobnih-podataka-politicara-u-lokalnim-medijima
|Original_Source_Language_1=Croatian
|Original_Source_Language_1=Croatian
|Original_Source_Language__Code_1=HR
|Original_Source_Language__Code_1=HR
Line 20: Line 20:


|Type=Complaint
|Type=Complaint
|Outcome=Upheld
|Outcome=Rejected
|Date_Started=
|Date_Started=
|Date_Decided=18.12.2020
|Date_Decided=
|Date_Published=09.08.2023
|Date_Published=
|Year=2020
|Year=
|Fine=
|Fine=
|Currency=
|Currency=


|GDPR_Article_1=Article 5(1)(b) GDPR
|GDPR_Article_1=Article 5(1)(c) GDPR
|GDPR_Article_Link_1=Article 5 GDPR#1b
|GDPR_Article_Link_1=Article 5 GDPR#1c
|GDPR_Article_2=Article 6(1) GDPR
|GDPR_Article_2=Article 6 GDPR
|GDPR_Article_Link_2=Article 6 GDPR#1
|GDPR_Article_Link_2=Article 6 GDPR
|GDPR_Article_3=
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_Link_3=
Line 42: Line 42:
|EU_Law_Link_2=
|EU_Law_Link_2=


|National_Law_Name_1=
|National_Law_Name_1=Article 3 Zakon o medijima
|National_Law_Link_1=
|National_Law_Link_1=https://www.zakon.hr/z/38/Zakon-o-medijima
|National_Law_Name_2=
|National_Law_Name_2=Article 7 Zakon o medijima
|National_Law_Link_2=
|National_Law_Link_2=https://www.zakon.hr/z/38/Zakon-o-medijima
|National_Law_Name_3=Article 8 Zakon o medijima
|National_Law_Link_3=https://www.zakon.hr/z/38/Zakon-o-medijima
|National_Law_Name_4=
|National_Law_Link_4=
|National_Law_Name_5=
|National_Law_Link_5=


|Party_Name_1=
|Party_Name_1=
Line 54: Line 60:
|Appeal_To_Body=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Status=
|Appeal_To_Link=
|Appeal_To_Link=


|Initial_Contributor=Tena
|Initial_Contributor=co
|
|
}}
}}


A picture identifying a police officer was posted as a comment on a video of a police operation available in a public Facebook group. The DPA found a violation of [[Article 5 GDPR#1b|Article 5(1)(b)]] and [[Article 6 GDPR#1|6(1) GDPR]] and ordered the removal of the photo.
The Croatian DPA rejected a complaint by a data subject, a politician, as unfounded since it considered the information published in two news articles to be a matter of public interest.


== English Summary ==
== English Summary ==


=== Facts ===
=== Facts ===
A 6 second video of a police officer on a motorcycle was posted on a publicly available Facebook group. While the face of the police officer was not visible in the video, someone published a picture taken when this officer was carrying out his duties, showing his face.
A media website published an article containing personal data about a data subject’s financial status, including a copy of the decision of the centre for social welfare granting him welfare and social benefits and the amounts thereof. Another website then published the same information and added that the data subject had been asked by the social welfare centre to do community service and failed to answer. The data subject in question is a politician and president of a political party in a Croatian town.  


The Border Police then reported the facts to the Croatian DPA, which opened an investigation. The DPA notified the person who posted the picture, as a controller, asking for a clarification on the purpose and legal basis for processing of the officer's personal data.
The data subject alleged that the editor had published personal data about his financial situation with the intention to discriminate against him by creating a “hostile, humiliating and insulting” environment. The media company submitted that it is among its tasks under the code of journalistic ethics to decide to publish certain information it believes to be in the public’s interest, as in this case.


The controller argued that they obtained the got the picture from Viber group chat and that unwittingly posted it on Facebook.
The data subject still claimed that his personal data should not have been published and asserted that such data had been forwarded to other recipients without a legal basis and filed a complaint with the AZOP.


=== Holding ===
=== Holding ===
The Croatian DPA held that the controller failed to demonstrate a legitimate purpose and legal basis for posting the picture on a publicly available Facebook group. It emphasized that the publication was not related to informing the public of any unlawful conduct from the police officer in the exercise of police power. Rather, the picture was published for the sole purpose of identifying the police officer. Therefore, the DPA found that there was no public interest in the publication of the police officer's picture.
The AZOP considered the case in light of the GDPR and the Croatian [https://www.zakon.hr/z/38/Zakon-o-medijima Media Act (''Zakon o medijima'')], which sets the conditions for information to be published on the media and guarantees freedom of expression, independence of the media, freedom to collect information and respect for human dignity. According to the Media Act, freedom of the media may only be restricted in a narrow set of cases where this is necessary in a democratic society, which also includes protection of the reputation or rights of others and prevent disclosure of confidential information. Article 7 of said act, however, states that public figures cannot expect the same level of protection as other citizens. Article 8 also states that when a justified public interest prevails, there can be no violation of the right to privacy. In addition to this, the Law on the Right to Access to Information stipulates that public authorities must publish information about granted grants and the beneficiaries thereof.  


For these reasons, the DPA found a violation of [[Article 5 GDPR#1b|Article 5(1)(b)]] and [[Article 6 GDPR#1|Article 6(1)]] and ordered the controller to delete the photograph, which was still accessible in a public Facebook group.
With regards to the articles in question, the AZOP held that the lawful basis for processing of personal data according to [[Article 6 GDPR#1|Article 6(1) GDPR]] are the provisions of the Media Act. As a consequence, the AZOP found that the information published about the complainant is to be considered a matter of public interest, especially given his political engagement.
 
Further, the AZOP did not consider that the controllers in this case failed to respect the principle of data minimisation of [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]] since information about these kinds of grants and how they are calculated is publicly available.
 
The AZOP thus rejected the complaint as unfounded.


== Comment ==
== Comment ==
Line 89: Line 99:
1
1
REPUBLIC OF CROATIA
REPUBLIC OF CROATIA
PERSONAL DATA PROTECTION AGENCY
PROTECTION AGENCY
PERSONAL DATA
CLASS:
CLASS:
NUMBER:
NUMBER:
Zagreb, December 18, 2020.
Zagreb, December 18, 2020.
Personal Data Protection Agency based on Article 57, paragraph 1 and 58, paragraph 1 and 2 of the Regulation
Personal Data Protection Agency based on Article 57, Paragraph 1 of Regulation (EU) 2016/679
(EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals in relation to
of the European Parliament and the Council of April 27, 2016 on the protection of individuals in connection with processing
with the processing of personal data and on the free movement of such data, as well as on its invalidation
personal data and on the free movement of such data and on repealing the Directive
Directive 95/46/EC (General Data Protection Regulation) SL EU L119, and Article 42, paragraphs 1 and 2.
95/46/EC SLEU L119 (hereinafter: General Regulation), Article 34 of the Law on the Implementation of the General
and Article 96 of the General Administrative Procedure Act ("Official Gazette", number: 47/09), and
Regulation on Data Protection ("Official Gazette", No. 42/18) and Article 96, Paragraph 1 of the Act on
acting ex officio, makes the following
general administrative procedure ("Narodne novine" no. 47/09), by official duty and occasion
requests for determining the violation of the right to protection of personal data XX from place XY brings
the following
SOLUTION
SOLUTION
1. It is established that the publication of personal data, i.e. a photograph of the police
Request for determination of violation of the right to protection of personal data XX from place X
of officer XX from Police Department X on September 22, 2020 at 11:18 a.m. by X from X
is rejected as unfounded.
in such a way that X is from X via his user profile X on a public social group
of the Facebook network on the URL link X in his comment that he made on the post under
under the name "X" published a photo of the above-mentioned police officer, it happened
processing of the personal data of the said police officer without a lawful purpose and legal
basis, contrary to Article 5 paragraph 1 point (b) and Article 6 paragraph 1 of the General Protection Regulation
data.
2. X from X is ordered to delete the photo of police officer X from Police Department X
which is still accessible via the URL link X and published without a lawful purpose i
legal grounds contrary to Article 5 paragraph 1 point (b) and Article 6 paragraph 1 of the General Regulation
on data protection.
3. A deadline of 15 days X from X is set for action according to point 2 of the sentence of the Decision and that o
inform the Personal Data Protection Agency of the same within 8 days.
Form layout
Form layout
The Agency for the Protection of Personal Data (hereinafter: the Agency) received it on September 28
The Agency for the Protection of Personal Data (hereinafter: the Agency) received a request for
2020 report of Border Police Station X (number: X, dated September 24, 2020 - further in
determination of violation of the right to protection of personal data XX from place X (hereinafter:
text: Report) in which it is essentially pointed out that on September 22, 2020, on Facebook
the applicant) in which he states that the responsible person in XY published his
profile of publicly available group “X” available at URL link: X posted video under
personal data in the media with the intention of discriminating against him, specifically that he is on the X portal
published an article entitled "X" (URL: X) in which his personal information was published.
As an attachment to his request, the applicant submitted a copy of the article in question.
Upon receipt of the request in question, the Agency, by the Ombudsman, Trg
hrvatski velikana 6, Zagreb received for competent processing the complaint XX from place X
(of the applicant) in which the applicant points out that the responsible person is in XY in the local
to the media and announced on his Facebook page that he is the same beneficiary of rights from social welfare and
as his information was published with the aim of creating a hostile, humiliating and
offensive environment that leads to discrimination based on financial status. Additionally in his
the complainant points out that his personal data was published on the following internet sites
2
2
with the name "X" lasting 6 seconds in which a police officer on a motorcycle was filmed, doc
pages/portals X (URL:X), X (URL:X) and X (URL:X). Also, with the complaint
the police officer's face is not visible. It is further pointed out that X is from X (hereinafter: X) via
a copy of the first page of the Decision of the Center for Social Welfare X, CLASS: X, was also forwarded
own Facebook profile X posted a comment on the above video in such a way that
ISSUE: X from June 11, 2018.
published a photo of a police officer of the Police Department X X (hereinafter: police
The request is not founded.
officer) during the time when the said police officer performed his official duty without
Acting on the request received and the complaint submitted by Pučki
existence of public interest in publishing the photograph.
of the ombudsman, the Agency requested the statement of XY i
For the purpose of accurate and complete determination of the factual situation and enabling the opposite party
responsible person XY regarding the forwarding of the applicant's personal data to others
(X) to present his statement regarding the relevant publication of the photo of the police officer on
recipients, as well as whether it is the same as a public authority, in accordance with Article 10, paragraph 1, point
own Facebook profile, the Agency requested in a letter on October 27, 2020
8 of the Act on the right to access information on its website
statement X in accordance with Article 51 of the Act on General Administrative Procedure, and regarding the circumstances from
information on granted grants and other assistance, including a list
Reports, which refer to the publication of a photo of a police officer, and in particular it is
user and amount.
requested statement on the legal purpose and legal basis from Articles 5 and 6 of the General Regulation on Protection
Further to the request, the Agency received a statement from XY in which it states how
data based on which the above photo was published in a public social group
did not forward the applicant's personal data to other recipients and does not have it at its disposal
of the Facebook network under the name: X".
data on the amount of compensation that the applicant as a beneficiary of the right receives from the system
On November 9, 2020, the Agency received the requested declaration X in which it expires
social welfare. Also, XY states that, as a public authority, it is not on its internet
how he obtained the photo of the police officer in question from a group on Viber and how it is
did not publish any information on the granted grants on the pages, and so on
unknowingly put her in the "X" group, and how he apologizes for what he did.
nor the list of beneficiaries and the amount.
Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals
Also, in a submission, CLASS: X, URBROJ: X, the Agency requested a statement from the company
in connection with the processing of personal data and the free movement of such data and the placement
X related to the applicant's statements as well as the legal basis and purpose for publishing personal data
out of force of Directive 95/46/EC (General Data Protection Regulation) SL EU L119 in its entirety
of the applicant.
binding and directly applicable and entered into force on May 25, 2018, for the application of which
Further to the request, the company in question made a statement stating that it was on April 2
and implementation on the territory of the Republic of Croatia is the competent Agency for Personal Protection
In 2020, the same published an article called "X" (URL:X) in which the name i
data.
the surname of the applicant and the amount he receives annually from the Center for Social Welfare
The General Data Protection Regulation applies to the processing of personal data in its entirety
X, in the interest of the public and the greater good, considering that XX performs in his public activity
performs automated and non-automated processing of personal data that are part of the system
as a politician and is also the president of the political party X based in X.
storage or are intended to be part of the storage system (Article 2 of the General Data Protection Regulation).
It is further stated that in the interest of the public and the greater good, the publications were checked
Personal data is all data relating to an individual whose identity has been or can be determined
information about a political worker who is also the leader of a local party and is in line with it
determine, and an individual whose identity can be determined is a person who can be identified directly
their duty as media to question such information even if it is in the interest of the public
or indirectly, especially with the help of identifiers such as name, identification number, information about
publish them in their medium.
Additionally, the company emphasizes that its task as a media is to stick to ethics
of the Journalist Code as well as publish information (including name and surname and key information for
specific case) if he considers that they are in the interest of the public.
Therefore, the company in question points out that it believes that the rights of the applicant are not
hurt considering that this is an active politician and media personality who publicly
has been active for years and is the leader of a political party.
In conclusion, the company points out that the information about the name and surname and the amount per year
fees (where they quoted XY) was used in the mentioned article and was not used in any other
purposes nor did it further process them.
3
From May 25, 2018, in all member states of the European Union, including in the Republic
The Regulation applies directly and bindingly to Croatia in the area of personal data protection
(EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals in relation to
with the processing of personal data and on the free movement of such data, as well as on its invalidation
Directive 95/46/EC (General Data Protection Regulation) SL EU 119.
The General Data Protection Regulation in Article 4, Paragraph 1, Point 1 stipulates that they are personal
data all data relating to an individual whose identity has been determined or can be determined, a
an individual whose identity can be established is a person who can be identified directly or
indirectly, especially with the help of identifiers such as name, identification number, information about
location, network identifier or with the help of one or more factors specific to the physical,
location, network identifier or with the help of one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that individual (Article
physiological, genetic, mental, economic, cultural or social identity of that individual.
4.1. General regulations on data protection).
Personal data must be processed legally, fairly and transparently with regard to
Personal data must be processed legally, fairly and transparently with regard to the subject,
of the respondent, collected for specific, express and lawful purposes, appropriate, relevant and limited
collected for specific, express and lawful purposes, appropriate, relevant and limited to what
to what is necessary in relation to the purposes for which they are processed (principle of reducing the amount of data),
is necessary in relation to the purposes for which they are processed (principle of reducing the amount of data), accurate and
accurate and, if necessary, up-to-date, processed in a way that ensures adequate security
as necessary, up-to-date, processed in a way that ensures adequate personal security
personal data, including protection against unauthorized or illegal processing and against accidental processing
data, including protection against unauthorized or illegal processing and against accidental loss,
loss, destruction or damage by applying appropriate technical or organizational measures
destruction or damage by applying appropriate technical or organizational measures (principle
(principle of integrity and confidentiality) (Article 5 of the General Data Protection Regulation).
integrity and confidentiality) (Article 5 of the General Data Protection Regulation).
Article 6 of the General Data Protection Regulation stipulates that processing is lawful only if
3
and to the extent that at least one of the following is fulfilled: a) the respondent has given consent for
The processing of personal data is legal only if and to the extent that the minimum is met
processing your personal data for one or more specific purposes; b) processing is necessary for
one of the following: the respondent has given his consent to the processing of his personal data in one or more
execution of a contract to which the respondent is a party or to take action upon request
special purposes; processing is necessary for the execution of a contract in which the respondent is a party or how
of the respondent before the conclusion of the contract; c) processing is necessary to comply with the manager's legal obligations
actions would be taken at the request of the respondent before the conclusion of the contract; processing is necessary for
processing; d) processing is necessary to protect the key interests of the data subject or other natural person;
compliance with the legal obligations of the controller; processing is necessary to protect key interests
e) processing is necessary for the performance of a task of public interest or in the exercise of official authority
legal obligations of the controller; processing is necessary for the performance of a task of public interest or
processing manager; f) processing is necessary for the legitimate interests of the controller or a third party
when exercising the official authority of the data controller; processing is necessary for legitimate interests
parties, except when those interests are stronger than the interests or fundamental rights and freedoms of the respondents who
data controller or third party (Article 6 of the General Data Protection Regulation).
require the protection of personal data, especially if the respondent is a child.
We also highlight the application of a special regulation, more specifically Article 2, Paragraph 1, Point 3 of the Law
Furthermore, we refer to the Media Act ("Official Gazette", number 59/04, 84/11 and 81/13)
on police duties and powers ("Official Gazette" no. 76/09, 92/14 and 70/19) in which
which prescribes the conditions under which information can be published as well as the rights and obligations of journalists
it is prescribed that a police officer of the Ministry of Internal Affairs is also an officer of a party
(publisher), media principles and obligations, and we point out that in Article 3, paragraphs 1 and 2, it is prescribed
of the police service, which is authorized according to the international agreement, this and other laws
to guarantee freedom of expression and freedom of the media, which includes, among other things, freedom
perform police duties, applying police powers.
expression of opinion, independence of the media, freedom of collection, research, publication and
In Article 9, Paragraph 3 of the Law on Civil Servants ("Official Gazette" No. 92/2005,
distribution of information in order to inform the public, availability of public information and
140/2005, 142/2006, 77/2007, 107/2007, 27/2008, 34/2011, 49/2011, 150/2011, 34/2012,
respect for the protection of human personality, privacy and dignity.
38/2013, 37/2013, 1/2015, 138/2015, 102/2015, 61/2017, 70/2019 and 98/2019) it is prescribed that
Freedom of the media may be restricted only when and to what extent it is necessary
civil servants have the right to the protection of physical and moral integrity during their work
democratic society for the sake of, among other things, territorial integrity or public order and peace,
official duties.
prevention of disorder or punishable acts, protection of health and morals, protection of reputation or rights of others,
In this administrative matter, it was established that X is through his own Facebook profile, which is accessible
on URL link X on September 22, 2020 at 11:18 a.m. in a publicly accessible Facebook group
named “X” available at the URL link X posted a comment on the post named “X”
in which he published a photo of police officer X while on duty
duties, and which photo is still publicly available via URL link: X to all
to users of the social network Facebook.
Considering that in his statement, X briefly referred to how he had unknowingly published the dispute
photo of a police officer in a publicly available Facebook group called "X" and how
apologizes for the aforementioned publication of the photo, X has not proven the existence of a legal basis for
the processing of personal data of a police officer, i.e. for the publication of a photograph through which
can clearly establish the identity of a police officer in the sense of Article 4, Paragraph 1, Point 1. General
regulations on data protection. Moreover, X did not refer to the legitimate purpose and legal basis of the publication
personal data of a police officer, and from which it is clear that at disposal
with the personal data of the police officer (publication of the photo of the police officer) is not
took into account the need to comply with Articles 5 and 6 of the General Data Protection Regulation, i.e
legal obligations that when processing the personal data of the respondent (here a police officer)
it must always have a special, explicit and lawful purpose and legal basis.
In this administrative matter, it was not determined that the subject publication of the photo would be related to
informing the public about the possible illegal behavior of a police officer on the occasion
of the application of police powers towards citizens, it has already been published for the purpose of making it clear
identification of the police officer following his stop at the bus station in
4
4
moment while he was performing his duties on a police motorcycle and how it stems from various factors
to prevent disclosure of confidential information or to preserve authority (Article 3, paragraph 3
comments that were published by Facebook users due to the dissatisfaction of residents of X
of the Media Act).
as a result of the allegedly too rigorous punishment of participants in public transport by the person in question
Also, the Law on Media in Article 7 paragraph 3 stipulates that a person who
of the police officer and the ongoing stop of the police officer at the bus station
statements, behavior and other acts related to her personal or family life alone
driving an official police motorbike. Since from the above posted video
attracts public attention cannot demand the same level of privacy protection as other citizens.
it is not possible to unequivocally establish the identity of the police officer, X is as given
There is no violation of the right to privacy if it prevails in terms of information
concluded decided to publish a photo of the police officer in question in which it is possible
justified public interest over the protection of privacy in relation to the activities of journalists or to
to establish the identity of the police officer in an unambiguous way so that all social users
information (Article 8 of the Media Act).
network Facebook knew exactly which police officer it was. Namely, on the disputed one
We emphasize that the Government of the Republic of Croatia, on the basis of Article 27 paragraph 1 of the Act on
the photo shows a police officer in the course of exercising his official powers, and on which
of social care ("Official Gazette", number 157/13) issued a Decision on the basis for calculating the amount
also finds an unknown citizen searching a laptop on a bench in a public square
guaranteed minimum fees, Class: 022-03/14-04/369, Registration number: 50301-04/12-14-2 dated 25.
on the surface, and from the photo in question, it is not clear possible illegal actions of the police
September 2014, which in point I stipulates that the basis on which the amount is calculated
official. From all of the above, it is clear that the publication of the disputed photo by X was not
the guaranteed minimum fee is HRK 800.00.
had as its sole aim (purpose) the disclosure of information to the public, which would indicate possible
In addition, we state that Article 10, Paragraph 1, Point 8 of the Law on the Right to
clearly illegal behavior of a police officer. Absence of lawful purpose and legal
access to information ("Narodne novine", 25/13 and 85/15) prescribed that public authorities
the basis from Articles 5 and 6 of the General Regulation on Data Protection is primarily evident from the
mandatory to publish on websites in an easily searchable and machine-readable form
X's statement in which he states that he unknowingly published the disputed photo of the police officer
information about granted grants, sponsorships, donations or others
official and that he apologizes for the aforementioned publication and did not refer to in any part
aid, including the list of beneficiaries and amount.
possible becoming a legitimate purpose and legal basis from Article 5 and 6 of the General Regulation on Protection
Following the above, in the conducted procedure based on established facts i
data, although the Agency explicitly stated this in its letter requesting a statement from X
of the collected evidence in this administrative matter, it was established that company X is on its own
emphasized.
published a newspaper article called "X" (URL:X) on the website (portal X).
Since X did not prove the existence of a legitimate purpose and legal basis for the publication of the photograph
By inspecting it, it is clear that the applicant's name and surname are published in it
of a police officer in a publicly available group on the social network Facebook called
the information that the same quote "is a member of the household who is able to work and who from the Center for Social Welfare already
"X", the described action resulted in a violation of Article 5, paragraph 1, point (b) and Article 6, paragraph
for a long time he receives annual compensation in the amount of HRK 9,600". Also, it is pointed out in the same that
1. General regulations on data protection.
the applicant as a person who heads a political party and as able-bodied
Considering the fact that the photo in question is still publicly available via URL
a member of the household receiving the guaranteed minimum compensation was obliged, in accordance with the provisions
links X to all users of the social network Facebook had to be ordered by Decision
of the Social Welfare Act, respond to XY's invitation to participate in works for the common good.
removal of photo of police officer. In accordance with everything stated, it was decided as in
Also, from the submitted complaint of the applicant to the People's Republic
Say the solutions.
to the ombudsman, which was delivered to this Agency, it was established that company X, and company X,
X and X also published personal data on their websites (portals).
of the applicant.
By looking at the article called "X" (URL:X) which was published on the Internet
pages (portal) X and in the article called "X" (URL:X), it is clear that it is in the same
the published name and surname of the applicant and the information that XY according to the data of the Center for
social welfare sent social assistance beneficiaries an invitation to work for the common good, which they did not respond to
answered the applicant.
5
Since in this particular case it is about the publication of an article on the Internet
i.e. internet portal X (X and X), the Media Act is applied as a separate law
which represents the legal basis for the collection and processing of personal data in accordance with Article 6.
General regulations on data protection.
Therefore, it should be noted that company X (that is, company X and company X)
lawfully collected the applicant's personal data since the same has a legal basis for
collection of information that may contain personal data of natural persons in accordance with the Law
about the media and that it has the right to inform the public about matters of public interest. Therefore taking
taking into account the above-mentioned Article 8 of the Media Act, in the specific case the public one prevails
interest in information about work for the common good of social assistance beneficiaries on call
XY over the protection of privacy and protection of personal data of the applicant. Especially because
in the specific case, the petitioner is a public person, at the head of a political party, who,
taking into account article 7 paragraph 3 of the Law on Media, it cannot demand the same level of protection
privacy like other citizens.
Also, related to the application of Article 5 of the General Regulation on data protection, especially important data
we state that the data controller should take care during each processing (publication) of personal data
on the purpose of processing (publication) of personal data, i.e. whether the processing (publication) of personal data
justified (legal), whether there is a legal basis for the processing (publication) of personal data and in
in the case when the existence of a justified (legal) purpose and legal basis for processing is established
(publication) of personal data must be guided by the principle of reducing the amount of data to
way that it is permissible to publish only the most necessary scope of personal data, depending on the purpose for which
personal data is published, and what is company X (that is, company X and company X) is described
the case did.
Accordingly, and taking into account the principles of processing from Article 5 of the General Regulation on Protection
data, especially the principle of reducing the amount of data, it should be pointed out that company X
as the processing manager in the specific case processed the applicant's personal data in
minimum scope (name and surname and the amount of the minimum fee on an annual level).
In this regard, it should be noted that the basis on which the amount is calculated is
guaranteed minimum compensation prescribed by the Government Decision and the same amounts to HRK 800.00, respectively
it is an amount that is publicly available. It is also necessary to refer to the provisions of the Act on
the right to access information and the duty for public authorities to take care of transparency
spending public funds from its budget. That is how the law in question is in Article 10, paragraph
1, point 8, prescribed the obligation of public authorities to publish information about the allocated
grants, sponsorships, donations or other assistance, including a list
user and amount.
Therefore, in the specific case, it was determined that when the article was published, company X
(ie company X and company X) took care to protect the privacy of the applicant and
processing principles from Article 5 of the General Data Protection Regulation.
6
As a result of the above, in the entire procedure, it was determined that it is for publication
of personal data found in the article called "X" (URL: X) as well as articles under
under the name "X" (URL:X) and "X" (URL: X) there was a legal basis from Article 6 of the General Regulation on
data protection and that the applicant's rights were not violated by publishing the name and surname.
Thus, it was determined that the said processing was not excessive, especially taking into account the scope
published data and the fact that in this particular case it is also about the spending of public funds
and that the applicant is a public person. Therefore, the described procedure did not occur
violation of the right to protection of personal data of the applicant.
In accordance with what was stated, it was decided as in the wording of the decision.
LEGAL REMEDY
LEGAL REMEDY
No appeal is allowed against this decision, but an administrative dispute can be initiated before the Administrative Court
An appeal against this decision is not allowed, but an administrative dispute can be initiated before the Administrative Court
by the court within 30 days from the date of delivery of the decision.
by the court in X within 30 days from the date of delivery of the decision.
DEPUTY DIRECTOR
DEPUTY DIRECTOR
Igor Vulje, B.Sc. Crimea.
Igor Vulje, B.Sc. Crimea.
 
 
Deliver:
Deliver:
1. X
1. XX
2. Stationery, here
2. X
5
3. X
4. X
5. X
6. Stationery, here
Note:
Note:
1. Police Department X, Border Police Station X
Ombudsman, Trg hrvatskih velikana 6, Zagreb
</pre>
</pre>

Latest revision as of 15:24, 30 October 2023

AZOP - Decision 18-12-2020
LogoHR.png
Authority: AZOP (Croatia)
Jurisdiction: Croatia
Relevant Law: Article 5(1)(c) GDPR
Article 6 GDPR
Article 3 Zakon o medijima
Article 7 Zakon o medijima
Article 8 Zakon o medijima
Type: Complaint
Outcome: Rejected
Started:
Decided:
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: Decision 18-12-2020
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Croatian
Original Source: AZOP (in HR)
Initial Contributor: co

The Croatian DPA rejected a complaint by a data subject, a politician, as unfounded since it considered the information published in two news articles to be a matter of public interest.

English Summary

Facts

A media website published an article containing personal data about a data subject’s financial status, including a copy of the decision of the centre for social welfare granting him welfare and social benefits and the amounts thereof. Another website then published the same information and added that the data subject had been asked by the social welfare centre to do community service and failed to answer. The data subject in question is a politician and president of a political party in a Croatian town.

The data subject alleged that the editor had published personal data about his financial situation with the intention to discriminate against him by creating a “hostile, humiliating and insulting” environment. The media company submitted that it is among its tasks under the code of journalistic ethics to decide to publish certain information it believes to be in the public’s interest, as in this case.

The data subject still claimed that his personal data should not have been published and asserted that such data had been forwarded to other recipients without a legal basis and filed a complaint with the AZOP.

Holding

The AZOP considered the case in light of the GDPR and the Croatian Media Act (Zakon o medijima), which sets the conditions for information to be published on the media and guarantees freedom of expression, independence of the media, freedom to collect information and respect for human dignity. According to the Media Act, freedom of the media may only be restricted in a narrow set of cases where this is necessary in a democratic society, which also includes protection of the reputation or rights of others and prevent disclosure of confidential information. Article 7 of said act, however, states that public figures cannot expect the same level of protection as other citizens. Article 8 also states that when a justified public interest prevails, there can be no violation of the right to privacy. In addition to this, the Law on the Right to Access to Information stipulates that public authorities must publish information about granted grants and the beneficiaries thereof.

With regards to the articles in question, the AZOP held that the lawful basis for processing of personal data according to Article 6(1) GDPR are the provisions of the Media Act. As a consequence, the AZOP found that the information published about the complainant is to be considered a matter of public interest, especially given his political engagement.

Further, the AZOP did not consider that the controllers in this case failed to respect the principle of data minimisation of Article 5(1)(c) GDPR since information about these kinds of grants and how they are calculated is publicly available.

The AZOP thus rejected the complaint as unfounded.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

1
REPUBLIC OF CROATIA
PROTECTION AGENCY
PERSONAL DATA
CLASS:
NUMBER:
Zagreb, December 18, 2020.
Personal Data Protection Agency based on Article 57, Paragraph 1 of Regulation (EU) 2016/679
of the European Parliament and the Council of April 27, 2016 on the protection of individuals in connection with processing
personal data and on the free movement of such data and on repealing the Directive
95/46/EC SLEU L119 (hereinafter: General Regulation), Article 34 of the Law on the Implementation of the General
Regulation on Data Protection ("Official Gazette", No. 42/18) and Article 96, Paragraph 1 of the Act on
general administrative procedure ("Narodne novine" no. 47/09), by official duty and occasion
requests for determining the violation of the right to protection of personal data XX from place XY brings
the following
SOLUTION
Request for determination of violation of the right to protection of personal data XX from place X
is rejected as unfounded.
Form layout
The Agency for the Protection of Personal Data (hereinafter: the Agency) received a request for
determination of violation of the right to protection of personal data XX from place X (hereinafter:
the applicant) in which he states that the responsible person in XY published his
personal data in the media with the intention of discriminating against him, specifically that he is on the X portal
published an article entitled "X" (URL: X) in which his personal information was published.
As an attachment to his request, the applicant submitted a copy of the article in question.
Upon receipt of the request in question, the Agency, by the Ombudsman, Trg
hrvatski velikana 6, Zagreb received for competent processing the complaint XX from place X
(of the applicant) in which the applicant points out that the responsible person is in XY in the local
to the media and announced on his Facebook page that he is the same beneficiary of rights from social welfare and
as his information was published with the aim of creating a hostile, humiliating and
offensive environment that leads to discrimination based on financial status. Additionally in his
the complainant points out that his personal data was published on the following internet sites
2
pages/portals X (URL:X), X (URL:X) and X (URL:X). Also, with the complaint
a copy of the first page of the Decision of the Center for Social Welfare X, CLASS: X, was also forwarded
ISSUE: X from June 11, 2018.
The request is not founded.
Acting on the request received and the complaint submitted by Pučki
of the ombudsman, the Agency requested the statement of XY i
responsible person XY regarding the forwarding of the applicant's personal data to others
recipients, as well as whether it is the same as a public authority, in accordance with Article 10, paragraph 1, point
8 of the Act on the right to access information on its website
information on granted grants and other assistance, including a list
user and amount.
Further to the request, the Agency received a statement from XY in which it states how
did not forward the applicant's personal data to other recipients and does not have it at its disposal
data on the amount of compensation that the applicant as a beneficiary of the right receives from the system
social welfare. Also, XY states that, as a public authority, it is not on its internet
did not publish any information on the granted grants on the pages, and so on
nor the list of beneficiaries and the amount.
Also, in a submission, CLASS: X, URBROJ: X, the Agency requested a statement from the company
X related to the applicant's statements as well as the legal basis and purpose for publishing personal data
of the applicant.
Further to the request, the company in question made a statement stating that it was on April 2
In 2020, the same published an article called "X" (URL:X) in which the name i
the surname of the applicant and the amount he receives annually from the Center for Social Welfare
X, in the interest of the public and the greater good, considering that XX performs in his public activity
as a politician and is also the president of the political party X based in X.
It is further stated that in the interest of the public and the greater good, the publications were checked
information about a political worker who is also the leader of a local party and is in line with it
their duty as media to question such information even if it is in the interest of the public
publish them in their medium.
Additionally, the company emphasizes that its task as a media is to stick to ethics
of the Journalist Code as well as publish information (including name and surname and key information for
specific case) if he considers that they are in the interest of the public.
Therefore, the company in question points out that it believes that the rights of the applicant are not
hurt considering that this is an active politician and media personality who publicly
has been active for years and is the leader of a political party.
In conclusion, the company points out that the information about the name and surname and the amount per year
fees (where they quoted XY) was used in the mentioned article and was not used in any other
purposes nor did it further process them.
3
From May 25, 2018, in all member states of the European Union, including in the Republic
The Regulation applies directly and bindingly to Croatia in the area of personal data protection
(EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals in relation to
with the processing of personal data and on the free movement of such data, as well as on its invalidation
Directive 95/46/EC (General Data Protection Regulation) SL EU 119.
The General Data Protection Regulation in Article 4, Paragraph 1, Point 1 stipulates that they are personal
data all data relating to an individual whose identity has been determined or can be determined, a
an individual whose identity can be established is a person who can be identified directly or
indirectly, especially with the help of identifiers such as name, identification number, information about
location, network identifier or with the help of one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that individual.
Personal data must be processed legally, fairly and transparently with regard to
of the respondent, collected for specific, express and lawful purposes, appropriate, relevant and limited
to what is necessary in relation to the purposes for which they are processed (principle of reducing the amount of data),
accurate and, if necessary, up-to-date, processed in a way that ensures adequate security
personal data, including protection against unauthorized or illegal processing and against accidental processing
loss, destruction or damage by applying appropriate technical or organizational measures
(principle of integrity and confidentiality) (Article 5 of the General Data Protection Regulation).
Article 6 of the General Data Protection Regulation stipulates that processing is lawful only if
and to the extent that at least one of the following is fulfilled: a) the respondent has given consent for
processing your personal data for one or more specific purposes; b) processing is necessary for
execution of a contract to which the respondent is a party or to take action upon request
of the respondent before the conclusion of the contract; c) processing is necessary to comply with the manager's legal obligations
processing; d) processing is necessary to protect the key interests of the data subject or other natural person;
e) processing is necessary for the performance of a task of public interest or in the exercise of official authority
processing manager; f) processing is necessary for the legitimate interests of the controller or a third party
parties, except when those interests are stronger than the interests or fundamental rights and freedoms of the respondents who
require the protection of personal data, especially if the respondent is a child.
Furthermore, we refer to the Media Act ("Official Gazette", number 59/04, 84/11 and 81/13)
which prescribes the conditions under which information can be published as well as the rights and obligations of journalists
(publisher), media principles and obligations, and we point out that in Article 3, paragraphs 1 and 2, it is prescribed
to guarantee freedom of expression and freedom of the media, which includes, among other things, freedom
expression of opinion, independence of the media, freedom of collection, research, publication and
distribution of information in order to inform the public, availability of public information and
respect for the protection of human personality, privacy and dignity.
Freedom of the media may be restricted only when and to what extent it is necessary
democratic society for the sake of, among other things, territorial integrity or public order and peace,
prevention of disorder or punishable acts, protection of health and morals, protection of reputation or rights of others,
4
to prevent disclosure of confidential information or to preserve authority (Article 3, paragraph 3
of the Media Act).
Also, the Law on Media in Article 7 paragraph 3 stipulates that a person who
statements, behavior and other acts related to her personal or family life alone
attracts public attention cannot demand the same level of privacy protection as other citizens.
There is no violation of the right to privacy if it prevails in terms of information
justified public interest over the protection of privacy in relation to the activities of journalists or to
information (Article 8 of the Media Act).
We emphasize that the Government of the Republic of Croatia, on the basis of Article 27 paragraph 1 of the Act on
of social care ("Official Gazette", number 157/13) issued a Decision on the basis for calculating the amount
guaranteed minimum fees, Class: 022-03/14-04/369, Registration number: 50301-04/12-14-2 dated 25.
September 2014, which in point I stipulates that the basis on which the amount is calculated
the guaranteed minimum fee is HRK 800.00.
In addition, we state that Article 10, Paragraph 1, Point 8 of the Law on the Right to
access to information ("Narodne novine", 25/13 and 85/15) prescribed that public authorities
mandatory to publish on websites in an easily searchable and machine-readable form
information about granted grants, sponsorships, donations or others
aid, including the list of beneficiaries and amount.
Following the above, in the conducted procedure based on established facts i
of the collected evidence in this administrative matter, it was established that company X is on its own
published a newspaper article called "X" (URL:X) on the website (portal X).
By inspecting it, it is clear that the applicant's name and surname are published in it
the information that the same quote "is a member of the household who is able to work and who from the Center for Social Welfare already
for a long time he receives annual compensation in the amount of HRK 9,600". Also, it is pointed out in the same that
the applicant as a person who heads a political party and as able-bodied
a member of the household receiving the guaranteed minimum compensation was obliged, in accordance with the provisions
of the Social Welfare Act, respond to XY's invitation to participate in works for the common good.
Also, from the submitted complaint of the applicant to the People's Republic
to the ombudsman, which was delivered to this Agency, it was established that company X, and company X,
X and X also published personal data on their websites (portals).
of the applicant.
By looking at the article called "X" (URL:X) which was published on the Internet
pages (portal) X and in the article called "X" (URL:X), it is clear that it is in the same
the published name and surname of the applicant and the information that XY according to the data of the Center for
social welfare sent social assistance beneficiaries an invitation to work for the common good, which they did not respond to
answered the applicant.
5
Since in this particular case it is about the publication of an article on the Internet
i.e. internet portal X (X and X), the Media Act is applied as a separate law
which represents the legal basis for the collection and processing of personal data in accordance with Article 6.
General regulations on data protection.
Therefore, it should be noted that company X (that is, company X and company X)
lawfully collected the applicant's personal data since the same has a legal basis for
collection of information that may contain personal data of natural persons in accordance with the Law
about the media and that it has the right to inform the public about matters of public interest. Therefore taking
taking into account the above-mentioned Article 8 of the Media Act, in the specific case the public one prevails
interest in information about work for the common good of social assistance beneficiaries on call
XY over the protection of privacy and protection of personal data of the applicant. Especially because
in the specific case, the petitioner is a public person, at the head of a political party, who,
taking into account article 7 paragraph 3 of the Law on Media, it cannot demand the same level of protection
privacy like other citizens.
Also, related to the application of Article 5 of the General Regulation on data protection, especially important data
we state that the data controller should take care during each processing (publication) of personal data
on the purpose of processing (publication) of personal data, i.e. whether the processing (publication) of personal data
justified (legal), whether there is a legal basis for the processing (publication) of personal data and in
in the case when the existence of a justified (legal) purpose and legal basis for processing is established
(publication) of personal data must be guided by the principle of reducing the amount of data to
way that it is permissible to publish only the most necessary scope of personal data, depending on the purpose for which
personal data is published, and what is company X (that is, company X and company X) is described
the case did.
Accordingly, and taking into account the principles of processing from Article 5 of the General Regulation on Protection
data, especially the principle of reducing the amount of data, it should be pointed out that company X
as the processing manager in the specific case processed the applicant's personal data in
minimum scope (name and surname and the amount of the minimum fee on an annual level).
In this regard, it should be noted that the basis on which the amount is calculated is
guaranteed minimum compensation prescribed by the Government Decision and the same amounts to HRK 800.00, respectively
it is an amount that is publicly available. It is also necessary to refer to the provisions of the Act on
the right to access information and the duty for public authorities to take care of transparency
spending public funds from its budget. That is how the law in question is in Article 10, paragraph
1, point 8, prescribed the obligation of public authorities to publish information about the allocated
grants, sponsorships, donations or other assistance, including a list
user and amount.
Therefore, in the specific case, it was determined that when the article was published, company X
(ie company X and company X) took care to protect the privacy of the applicant and
processing principles from Article 5 of the General Data Protection Regulation.
6
As a result of the above, in the entire procedure, it was determined that it is for publication
of personal data found in the article called "X" (URL: X) as well as articles under
under the name "X" (URL:X) and "X" (URL: X) there was a legal basis from Article 6 of the General Regulation on
data protection and that the applicant's rights were not violated by publishing the name and surname.
Thus, it was determined that the said processing was not excessive, especially taking into account the scope
published data and the fact that in this particular case it is also about the spending of public funds
and that the applicant is a public person. Therefore, the described procedure did not occur
violation of the right to protection of personal data of the applicant.
In accordance with what was stated, it was decided as in the wording of the decision.
LEGAL REMEDY
An appeal against this decision is not allowed, but an administrative dispute can be initiated before the Administrative Court
by the court in X within 30 days from the date of delivery of the decision.
DEPUTY DIRECTOR
Igor Vulje, B.Sc. Crimea.
Deliver:
1. XX
2. X
3. X
4. X
5. X
6. Stationery, here
Note:
Ombudsman, Trg hrvatskih velikana 6, Zagreb