AZOP (Croatia) - Decision 30-12-2021

AZOP (Croatia) - Decision 30-12-2021
Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 5(1)(a) GDPR Article 6(1) GDPR Article 3(1) Media Act Article 3(2) Media Act Article 3(3) Media Act Article 8 Media Act
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	30.12.2021
Published:	25.01.2022
Fine:	None
Parties:	n/a
National Case Number/Name:	Decision 30-12-2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Croatian
Original Source:	AZOP Decision Database (in HR)
Initial Contributor:	Giel Ritzen

The Croatian DPA rejected a data subject’s complaint against a newspaper, claiming it did not have a legal basis to publish their personal data. The DPA held that the processing was necessary for the public interest and that there was no violation of Article 5(1)(a) GDPR.

English Summary

Facts

The controller in this case is an online newspaper which published an article regarding the spending of public funds within a European Union funded programme. In this article, the newspaper published a data subject’s name, last name, and the fee data subject earned for their work as part of the programme. The data subject claimed the newspaper did not have a legal basis to share their personal data, and filed a complaint with the Croatian DPA.

Holding

The Croatian DPA rejected the complaint. It considered that, in principle, the newspaper has a legal basis that follows from Article 3(1) and 3(2) of the Croatian Media Act (Official Gazette 59/04, 84/15, 81/13) which protects freedom of expression of the media. According to this law, the newspaper has the right to inform the public about matters of public interest. In this case, the DPA found that information on the how public authorities spend public funds must be considered in the public interest. Moreover, the DPA held that the processing of personal data was not excessive, and limited to what was necessary. Hence, the DPA concluded that the newspaper had a legal basis under Article 6(1) GDPR to publish the data subject’s personal data, and did not violate Article 5(1)(a) GDPR.

Comment

In the decision, the Croatian DPA speaks of "public interest" when legitimising the processing of personal data. Hence, it seems that the DPA refers to Article 6(1)(e) GDPR as the legal basis for processing personal data. However, this legal basis is normally only reserved for public authorities that carry out tasks in the public interest, or private parties that are tasked by law to perform a specific public interest. It is highly unlikely that private parties, such as the newspaper, can rely on Article 6(1)(e) GDPR, since the requirements to rely on this legal basis are not fulfilled. Hence, perhaps, the Croatian DPA meant to refer to Article 6(1)(f) GDPR instead (like a similar case by the Cyprian DPA). Since the DPA only referred to Article 6(1) GDPR, and did not specify the exact legal basis, this is (sadly) unclear.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

Übersetzungstypen
Textübersetzung
Ausgangstext
4.951 / 5.000
Übersetzungsergebnisse
1
REPUBLIC OF CROATIA
PROTECTION AGENCY
PERSONAL DATA
CLASS:
REGISTRATION NUMBER:
Zagreb, 30 December 2021
Personal Data Protection Agency pursuant to Article 57 (1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data 95/46 / EC SLEU L119 (hereinafter: the General Regulation), Article 34 of the Act implementing the General Regulation on Data Protection (Official Gazette 42/18) and Article 96 (1) of the Act
General Administrative Procedure (Official Gazette No. 47/09), ex officio and on the request for a violation of the right to protection of personal data of the applicant, issues the following

SOLUTION
The request for a violation of the applicant's right to protection of personal data is rejected as unfounded.

Explanation

The Agency for Personal Data Protection (hereinafter: the Agency) received a request for a violation of the applicant's right to protection of personal data stating that portal x or their journalist had published an article and that
Unauthorized article published his personal data - name and surname and the fee he earned for the work done within the project School for Life. Also, the applicant states that the published data are accurate and that the article can be found at the following link:… The request is unfounded. As of 25 May 2018, in all Member States of the European Union, including the Republic of Croatia in the field of personal data protection, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals is directly and bindingly applicable concerning the processing of personal data and the free movement of such data and the repeal of Directive 95/46 / EC (General Data Protection Regulation) OJ EU 119.
The General Data Protection Regulation stipulates in Article 4 (1) (1) that personal data are all data relating to an identified or identifiable individual, and the identifiable individual is a directly identifiable person. or indirectly, in particular by means of identifiers such as name, identification number, location data, network identifier or by one or more factors specific to that individual's physical, physiological, genetic, mental, economic, cultural or social identity.
Personal data in accordance with Article 5 of the General Regulation on Data Protection must: a) be processed lawfully, fairly and transparently with regard to the respondent; b) collected for special, explicit and lawful purposes; c) appropriate, relevant and limited to what is necessary in relation to
the purposes for which they are processed (the principle of reducing the amount of data); d) accurate and, where appropriate, up-to-date; f) processed in a manner that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or
damage by applying appropriate technical or organizational measures (principle of integrity and confidentiality). Article 6 of the General Data Protection Regulation stipulates that processing is lawful only if and to the extent that at least one of the following is met: a) the respondent has consented to the processing of his or her personal data for one or more special purposes; b) processing is necessary for the performance of the contract to which the respondent is a party or in order to take action at the request of the respondent prior to the conclusion of the contract; c) the processing is necessary in order to comply with the legal obligations of the controller; d) processing is necessary to protect the key interests of the respondent or other natural person; e) processing is necessary for the performance of a task of public interest or in the exercise of official authority
processing manager; f) processing is necessary for the legitimate interests of the controller or a third party, except where those interests are stronger than the interests or fundamental rights and freedoms of the respondent requiring the protection of personal data, especially if the respondent is a child. Following the above, in the specific case for the processing of personal data by the media, the Media Act (Official Gazette 59/04, 84/15, 81/13) is applied as a special law, which, among other things, regulates the preconditions for exercising the principles of freedom of the media, the right of journalists and other participants in public information to freedom of reporting and access to public information, the rights and obligations of publishers, the exercise of the right to correction and response, etc. freedom of expression and
freedom of the media, which includes, inter alia, freedom of expression, independence of the media, freedom to collect, research, publish and distribute information for the purpose of informing the public, access to public information and respect for the protection of human rights.
personality, privacy and dignity. Furthermore, media freedoms are allowed to be restricted only when and to the extent necessary in a democratic society Übersetzungstypen
Textübersetzung
Ausgangstext
4.957 / 5.000
Übersetzungsergebnisse
in the interests of, inter alia, territorial integrity or public order,
prevention of riots or criminal offenses, protection of health and morals, protection of reputation or rights of others, prevention of disclosure of confidential information or for the purpose of preserving authority (Article 3, paragraph 3 of the Media Act).
Since the Media Act is applicable in this particular case, as a separate law, it is the legal basis for the collection and processing of personal data in accordance with Article 6, paragraph 1 of the General Data Protection Regulation. The said law prescribes the conditions under which
information can be published as well as the rights and obligations of journalists (publishers), media principles and obligations, and from the above it follows that in this case it is an article that is publicly available on portal x, or that in this case it is a provider of electronic publications y (hereinafter y) which, in accordance with Article 2 of the Media Act, is a medium, ie an electronic publication. The Personal Data Protection Agency is not responsible for reviewing whether certain information is accurate and verified, or whether the information as such should have been published in
media. Therefore, in accordance with the Media Act, everyone has the right to request the Editor-in-Chief to publish a correction of published information that violated his rights or interests free of charge (Article 40) and to request his response to published information free of charge. his name or is otherwise directly related to it (Article 56). There is no violation of the right to privacy protection if, in terms of information, a justified public interest prevails over the protection of privacy in relation to the activity of journalists or information (Article 8 of the Media Act). Furthermore, Article 16 of the Law on the Right to Access Information (Official Gazette 25/13, 85/15) states that the public authority responsible for handling a request for access to information is obliged to conduct a proportionality test before making a decision. and public interest, while information on the disposal of public funds is available to the public without conducting a test
proportionality, unless the information constitutes classified information.
Following the above, in the conducted procedure on the basis of established facts and collected evidence in this administrative matter, it was established that the company y published a newspaper article on its website. Insight into the same shows that along with the mentioned article, a document / table was published - Payments (1.3.-31.12.2018.) Within the EU project "Support to the implementation of Comprehensive Curricular Reform" (CKR I) in which the following data were published: selected bidder; duration, type of contract, agreed amount.Therefore, it should be noted that the company y legally collected and made public
personal data of the applicant as it has a legal basis for collecting information that may contain personal data of natural persons in accordance with the Media Act and has the right to inform the public about matters of public interest. Therefore, taking into account the above-mentioned Article 8 of the Law on Media, in this case the public interest in information on the disbursement of funds related to the work within the project "Support to the implementation of Comprehensive
curricular reforms ”in which the project is carried out by the Ministry of Science and Education, and which is co-financed by the European Union from the European Social Fund. Also, in connection with the application of Article 5 of the General Regulation on Data Protection, we state that it is particularly important that the head of processing should take into account every processing (publication) of personal data.
on the purpose of processing (publication) of personal data, ie whether the processing (publication) of personal data is justified (legal), whether there is a legal basis for processing (publication) of personal data and in case the existence of justified (legal) purpose and legal basis for the processing (publication) of personal data it is necessary to be guided by the principle of reducing the amount of data in such a way that it is permissible to publish only the most necessary range of personal data, depending on the purpose for which
personal data are published, and what company y did in the described case. Furthermore, taking into account the principles of processing set out in Article 5 of the General Data Protection Regulation, in particular the principle of data reduction, it should be noted that company y as a manager
processing in the specific case processed the personal data of the applicant to a minimum extent (name and surname, duration, type of contract and the agreed amount). In this regard, it should be noted that on October 22, 2018, the Ministry of Labor and Pension System issued a Decision on financing CLASS: 910-04 / 17-09 / 125,
REGISTRATION NUMBER: 524-06-04-02 / 1-18-9 which finances the following operations: UP.03.2.2.04.0001 Support to the implementation of the Comprehensive Curricular Reform (CKR), Ministry of Science and Education, in the maximum amount of eligible costs 155,138,324 , 29 HRK. Furthermore, it should be emphasized that the right to protection of personal data is not absolute will be processed under the conditions defined by special regulations. In this particular case, it is about data related to the spending of public funds, which should be available for the transparent work of public authorities, having in mind the provision of Article 16, paragraph 3 of the Act
on the right of access to information. In this case, it is a question of spending the funds of public authorities, which represents the disposal of public or budgetary funds. For the stated information, the law implies the public interest, ie the right of all natural and
legal entities to know how and for what purpose public funds are used. Following the above, in the entire procedure, it was established that there was a legal basis for the publication of personal data under Article 6 of the General Data Protection Regulation and that the publication of this range of personal data did not violate the rights of the applicant. Therefore, it was determined that the mentioned processing was not excessive, especially taking into account the scope of the published data and the fact that in this particular case it is also a matter of spending public funds. Therefore, the described conduct did not violate the applicant's right to protection of personal data. In accordance with the above, it was decided as in the dictum of the decision.
5
INSTRUCTIONS ON LEGAL REMEDY
No appeal is allowed against this decision, but an administrative dispute may be initiated before the Administrative Court in Zagreb within 30 days from the day of delivery of the decision.
 
DEPUTY DIRECTOR
 Igor Vulje