AZOP (Croatia) - Fine against a utilities company
| AZOP - Fine against a utilities company | |
|---|---|
 | |
| Authority: | AZOP (Croatia) |
| Jurisdiction: | Croatia |
| Relevant Law: | Article 31 GDPR Article 32 GDPR Article 32(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | 320,000 EUR |
| Parties: | HEP-Toplinarstvo |
| National Case Number/Name: | Fine against a utilities company |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Croatian |
| Original Source: | AZOP (in HR) |
| Initial Contributor: | ap |
The DPA fined a utilities company €320,000 for failing to implement security measures when issuing new passwords to its users, and for not cooperating with the DPA.
English Summary
Facts
HEP-Toplinarstvo (the controller) is a utilities company. The DPA investigated the controller following a complaint from a data subject. The data subject requested to change their password for their account, and was sent the reset password by e-mail. According to the data subject, the controller simply sent them the last password that they had set for the account. During its investigations, the DPA found that the controller had stored all user passwords (nearly 16,000) in a database in readable form.
Holding
The DPA found a violation of Article 32 GDPR. The controller did not implement appropriate technical and organisational measures to ensure data security when processing the users’ data. By storing the users’ passwords in readable form, the controller risked unauthorised disclosure to third parties and misuse of the data (Article 32(2) GDPR). Furthermore, the DPA stated that the controller had deliberately chosen to not implement a password recovery system with security measures (such as issuing an interim password or using data encryption). The controller had also not considered the risks in processing personal data, as it did not carry out a risk assessment. Finally, the controller did not implement measures after being informed of the potential violation of Article 32 GDPR, and did not inform data subjects.
In addition, the controller violated Article 31 GDPR by not cooperating with the DPA. During the proceedings, the controller did not provide the DPA full access of the necessary information.
The DPA fined the controller €320,000.
Comment
This summary is based on a press release of the DPA. The press release has no date, however, other websites mention this fine on 22.07.2025.
Further Resources
This case was mentioned in this website and this website.
English Machine Translation of the Decision
The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.
Two administrative fines of 370,000 euros imposed HEP-Toplinarstvo fined 320,000 euros The Personal Data Protection Agency imposed an administrative fine of 320,000 euros on HEP-Toplinarstvo as the controller for violating the provisions of the General Data Protection Regulation, specifically for failing to take appropriate technical and organizational protection measures when processing personal data and for failing to cooperate with the Agency, whereby HEP-Toplinarstvo did not provide access to information necessary for the performance of the Agency's tasks. The Agency received a report from a respondent that when requesting a change of a forgotten password on the HEP-Toplinarstvo "My Account" portal, the user is sent a temporary password by e-mail, which is actually the last password set by the user. During the supervisory procedure, it was determined that when creating the conceptual design of the "My Account" application, a method of changing a forgotten password was established so that the user is sent the same password that is entered in the application database for that user (and which the user set himself) to his email as a temporary password, and that all passwords of users of the "My Account" portal (almost 16,000 of them) are stored in the database of the controller in readable form. Considering the above, since user passwords are stored in the database of the controller in readable form, the personal data of users of the "My Account" application are exposed to the risk of unauthorized disclosure and misuse, which, according to Article 32, paragraph 2 of the General Data Protection Regulation, represents one of the key security risks that the controller was obliged to previously assess and combat by taking appropriate personal data security measures. However, the controller consciously chose a solution that did not include basic data protection security measures, such as generating a temporary password or using data encryption methods, did not take into account the risks to the security of personal data, nor did it conduct a risk assessment of the processing of users' personal data. During the procedure, the controller did not demonstrate an appropriate level of cooperation to eliminate the breach and mitigate the possible harmful effects. Also, the controller did not provide the Agency with evidence of changes to the functionality of the application, nor did it take measures to mitigate the possible harmful effects of the breach of Article 32 of the General Data Protection Regulation after learning about the security breach, such as informing the data subjects. Finally, during the supervisory procedure, the controller did not provide the Agency with access to all information necessary to perform its tasks. Such conduct constitutes non-cooperation with the Agency as a supervisory authority, which is contrary to Article 31 of the General Data Protection Regulation. Otherwise, in 2025, the Agency imposed twelve administrative fines, bringing the total amount of fines imposed this year to 900,500.00 euros.
