OGS Zagreb - Pn-1378/2023-18

OGS Zagreb - Pn-1378/2023-18
Court:	OGS Zagreb (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 19 of the Obligations Act
Decided:	05.12.2025
Published:
Parties:
National Case Number/Name:	Pn-1378/2023-18
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s):	Croatian
Original Source:	OGS Zagreb (in Croatian)
Initial Contributor:	RP

A court awarded €3,500 to a data subject after a bank mistakenly sent her financial data to another client, finding that the disclosure unlawfully violated her right to privacy and caused non-material damages.

English Summary

Facts

On 16 July 2021, a data subject and a bank (the controller) concluded a Custody Agreement for Financial Instruments. Under this agreement, the bank had to open a custody account for the data subject, safeguard and settle financial instruments, report on account activity, collect income, and keep the data subject informed about the status and changes of the custody account. On the same day, the parties also concluded a Service Agreement, which defined the rights and obligations related to that service. Article 4 of this agreement required the bank to keep all client information confidential in accordance with applicable laws and prohibited disclosure to third parties without written consent or a legal basis.

On 11 January 2023, the controller mistakenly sent the data subject’s monthly custodial account statement, which contained sensitive personal and financial data, to another client instead of the data subject. The controller requested that the unintended recipient delete the email and corrected the technical error. The data subject remained uncertain about the extent of the data disclosure.

Subsequently, she initiated a lawsuit claiming that this incident caused stress, anxiety, discomfort, and a loss of trust in the controller, and requested compensation for non-material damages.

Holding

The Court held that the controller violated the data subject’s right to privacy under Croatian law and that this violation constituted non-material damage. It also referred to the violation of GDPR, without pointing out any specific article. The Court awarded compensation on the basis of Croatian civil law, specifically the rules on protection of personality rights and non-material damages under the Croatian Obligations Act.

The court explained that the right to privacy is a personal non-property right that gives an individual full authority over their private life, including the ability to exclude others from accessing, collecting, or disclosing personal data without consent. Because the controller, a bank entrusted with confidential financial information, sent the data subject’s account statement to another client without consent, the court found that the disclosure amounted to an unauthorized intrusion into the data subject’s privacy.

The court then assessed whether monetary compensation was justified. It emphasised that the controller did not provide the misdirected email, which prevented verification of the exact content disclosed. Although the controller asserted that only a monthly custody account statement was sent and that the unintended recipient deleted the message, the court held that these claims did not eliminate uncertainty about what was actually shared or whether it was further disseminated. This uncertainty increased the seriousness of the violation because the data subject could not know the full scope of possible consequences. The court therefore accepted that the data subject experienced mental distress, fear, and ongoing concern about how their personal and financial data might have been used.

The court rejected the controller’s argument that no harm occurred because the data subject remained a client. It noted that the data subject terminated one of the custody accounts after the incident, reflecting a change in trust, but that the continuation of some services did not negate the harm suffered.

When determining the amount of compensation, the court considered the intensity and duration of the data subject’s anxiety, including discomfort arising from knowing that another person had access to their personal and financial information and fears of potential burglary or extortion. The court also highlighted that the controller is a financial institution, which carries a heightened duty of professionalism and diligence due to the sensitive nature of the data it processes. Considering these circumstances and the purpose of non-material damages, the court found that €3,500 constituted fair compensation.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

REPUBLIC OF CROATIAMUNICIPAL CIVIL COURT IN ZAGREBUlica grada Vukovara 84Registration number: Pn-1378/2023-18IN THE REPUBLIC OF CROATIAJUDGMENTMunicipal Civil Court in Zagreb, by the judge of that court, Dr. Sc. Dijana Vragović, in the legal matter of the plaintiff UP, OIB: [personal identification number], [address], represented by attorney Marko Židić, attorney in Zagreb, against the defendant Zagrebačka banka d.d., OIB: 92963223473, Zagreb, Trg bana Josipa Jelačića 10, represented by attorneys UPH and other attorneys in the Law Firm Hanžeković & partners in Zagreb, for the purpose of compensation for damage, after the main and public hearing held and concluded on October 10, 2025 in the presence of the plaintiff's attorney and the plaintiff himself and the defendant's attorney, on December 5, 2025, the judgment is The defendant Zagrebačka banka d.d., OIB: 92963223473, Zagreb, Trg bana Josipa Jelačića 10, is ordered to pay the plaintiff UP, OIB: [personal identification number], [address], the amount of EUR 3,500.00 together with default interest accrued on that amount from 10 February 2023, at a rate determined, until 31 December 2023, for each half-year, by increasing the interest rate applied by the European Central Bank to its most recent main refinancing operations carried out before the first calendar day of the current half-year by three percentage points, and from 1 January 2024 until payment at a rate determined, for each half-year, by increasing the reference rate, i.e. the interest rate applied by the European Central Bank to its most recent main refinancing operations or the marginal interest rate resulting from the tender procedures for the variable the rate for the last main refinancing operations of the European Central Bank, by three percentage points, whereby for the first half of the year the reference rate in force on 1 January shall apply, and for the second half of the year the reference rate in force on 1 July of that year, within 15 days.II. The defendant is ordered to reimburse the plaintiff for the costs of these proceedings in the amount of EUR 1,372.18, with default interest running from 5 December 2025 at a rate determined, for each half-year, by increasing the reference rate, i.e. the interest rate applied by the European Central Bank to its most recent main refinancing operations or the marginal interest rate resulting from the variable rate tender procedures for the most recent main refinancing operations of the European Central Bank, by three percentage points, whereby for the first half-year the reference rate in force on 1 January shall apply, and for the second half-year the reference rate in force on 1 July of that year, within 15 days. Reasoning 1. The plaintiff states in the lawsuit that the parties entered into a Custody Agreement for Financial Instruments concluded on July 16, 2021, by which the defendant as a bank undertook to open a custody account for the plaintiff as a client, store and safeguard financial instruments, settle financial instruments, report to the client on the activities of the companies and collect income from financial instruments, and report to the client on the status and changes in custody accounts. On July 16, 2021, the parties entered into a ZABA Preferred Partners Service Agreement, by which the parties regulate their rights and obligations in connection with the ZABA service. Therefore, according to the provision of Article 4 of the Agreement on ZABA Preferred Partners service, it is agreed that the Bank is obliged to keep information from the Agreement and information about the Clients and the status and turnover of the Clients' Shares as a secret in accordance with all applicable regulations and will not disclose, make available to third parties or use them in any way, except for the purposes of implementing the Agreement, i.e. orders based on it and in the cases and in the manner determined by the relevant regulations, the agreement and the Statement in which the client gave the bank written consent to the disclosure of certain confidential information. The obligation to keep bank secrecy, which is represented by all data, facts and circumstances that the credit institution learned on the basis of providing services to clients and performing business with individual clients, is also regulated by the provisions of Articles 156 and 157 of the Law on Credit Institutions. On 12 January 2023, the plaintiff received a notification from the defendant's employee that the defendant, when sending the monthly custody account report, sent the report to the email address(es) of a third party instead of to the plaintiff's email address. Given that the plaintiff's monthly custody account report contains strictly personal data, the defendant's conduct directly violated the plaintiff's personal data, which the defendant, as the controller, is obliged to process in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC and the General Data Protection Regulation Implementing Regulation. The defendant's conduct described above primarily violated the plaintiff's right to privacy, as one of the components of personality rights. Also, and bearing in mind that this is strictly personal data, which, among other things, constitutes banking secrecy, that the perpetrator of the alleged violation is a credit institution that is obliged to handle such data with particular care, as well as the danger arising from this, the plaintiff's knowledge of the disclosure of her data to unknown third parties caused fear, anxiety, discomfort and loss of trust in the plaintiff. As a result of the above, she claims compensation for non-pecuniary damage suffered in the amount of EUR 3,500.00 with the associated default interest and procedural costs.2. The defendant in his response to the lawsuit does not dispute that the defendant and the plaintiff entered into a contractual relationship based on the Agreement on Custody of Financial Instruments concluded on 16.07.2021. and on the basis of the Agreement on ZABA Preferred Partners Service concluded on 16.07.2021. It is also not disputed that on 11.01.2023. when sending monthly reports on the status of custody accounts on the reporting date 31.12.2023, due to an unintentional technical error, the monthly report on the status of the plaintiff's custody account was sent to the email address of another client of the Bank. The defendant immediately reacted to the aforementioned error by requesting the recipient to permanently destroy the received report. Also, the defendant immediately eliminated the technical error that led to the described event and took all measures to prevent the situation from recurring. As a result of the above, the defendant emphasizes that he believes that the described event, with all subsequent measures taken, did not cause the plaintiff any damage and that therefore the plaintiff's claim for compensation for damage is unfounded and unfounded.3. During the evidentiary proceedings, the court inspected the Agreement on Custody of Financial Instruments dated July 16, 2021 with attachments (sheets 6-16), the Agreement on ZABA Preferred Partners Service dated July 16, 2021 with attachments (sheets 17-23), e-mail correspondence of the parties (sheets 24-26), the Claim for Compensation (sheets 30-31), the Defendant's letters (sheets 27-29), a copy of the report on the status of custody accounts (sheet 40), Information on the breach of personal data (sheet 41), e-mail correspondence between the Defendant and a third party, VP (sheets 94-95), and the Plaintiff was heard (sheets 182-183). 4. Evaluating the results of the evidence presented, in accordance with the provision of Art. 8. of the Civil Procedure Act (Official Gazette, No. 53/91, 91/92, 112/99, 88/01, 117/03, 88/05, 84/08, 123/08, 57/11, 25/13, 70/19, 80/22, 114/22 and 155/23, hereinafter referred to as the Civil Procedure Act), the court found that the plaintiff's claim was well-founded.5. The subject of the dispute in these proceedings is the plaintiff's claim for compensation for non-pecuniary damage due to the violation of the right to privacy in the amount of EUR 3,500.00, which damage occurred due to the disclosure of the plaintiff's personal and banking data.6. In the specific case, it is not disputed: - that the parties are in a contractual relationship, - that the defendant is under a contractual (Article 4 of the ZABA Preferred Partners Service Agreement of July 16, 2021 and Article 6 of the Custody of Financial Instruments Agreement of July 16, 2021) and legal obligation to keep the plaintiff's data that it learned on the basis of providing services to clients and performing transactions with an individual client (Articles 156 and 157 of the Credit Institutions Act (Official Gazette No. 159/13, 19/15, 102/15, 15/18, 70/19, 47/20, 146/20 and 151/22, hereinafter the ZKI), - that on January 11, 2023, the defendant provided the plaintiff's personal and banking data to a third party instead of the plaintiff. 6.1. It is disputed whether thereby the plaintiff suffered non-pecuniary damage as well as the amount of non-pecuniary damage claimed by the plaintiff.7. Personal rights, within the meaning of the provisions of Article 19 of the Civil Obligations Act (Official Gazette, No. 35/05, 41/08, 125/11, 78/15, 29/18, 126/21, 114/22, 156/22, 145/23 and 155/23, hereinafter referred to as the ZOO), are understood to mean the rights to life, physical and mental health, reputation, honour, dignity, name, privacy of personal and family life, freedom, etc.7.1. The provision of Article 1100, paragraphs 1 and 2 of the ZOO stipulates that in the event of a violation of personal rights, if it finds that the gravity of the violation and the circumstances of the case justify it, the court shall award fair monetary compensation, regardless of compensation for material damage, and even if there is none. When deciding on the amount of fair monetary compensation, the court will take into account the severity and duration of the physical pain, mental pain and fear caused by the injury, the purpose served by the compensation, but also that it does not favor aspirations that are incompatible with its nature and social purpose.8. In order to determine whether the defendant's actions violated the right to privacy and whether the severity of the injury and the circumstances of the case justify the award of fair monetary compensation and its amount, the court heard the plaintiff and reviewed the documentation attached to the file.8.1. It follows from the parties' e-mail correspondence on pages 24-26 of the file that the bank informed the plaintiff on January 12, 2023 that on January 11, 2023, when sending monthly reports on the status of custody accounts on the reporting date of December 31, 2022, the plaintiff's report on the status of the custody account was made available to another client of the bank due to a technical error.The bank states that it has eliminated the technical error that led to the aforementioned event and that all measures have been taken to prevent the situation from recurring, states that the protection of clients' personal data is extremely important to the bank, apologizes for the aforementioned situation and hopes that the aforementioned will not affect the trust of the client, in this case the plaintiff, in the bank.8.2. From the e-mail correspondence between the bank and the VP on pages 94-95 of the file, it follows that the VP responded to the defendant's e-mail regarding the request to delete the incorrectly sent e-mails, stating that the above-described error had occurred and that the recipient requested that all received e-mails and attachments be deleted, and that the bank be notified of the aforementioned action in order to confirm that they had acted upon the bank's request, by confirming the deletion.8.3. In his statement, the plaintiff essentially stated that he had been in a business relationship with the defendant his entire life. His entire family had placed financial resources at the bank's disposal, and they had received a contract from which it follows that they were protected with regard to their personal and other data. These are his and his family's private funds. He claims that their data went somewhere uncontrolled. They don't know to whom because they only received a notification from the bank that their data went to several e-mail addresses, but they didn't want to say to whom the data went. The bank used to send them a monthly report that included their personal data, OIB, addresses and certain financial amounts and contract terms. At that time, they panicked because it was not known where the data went and the bank didn't want to say. The bank later told them that the recipient of that email destroyed the email, but there is no evidence of that, nor do they want to tell them how many addresses it went to. They received information from the bank that a report on the balance of the custodial accounts was sent incorrectly, but they don't actually know what exactly went, or what data about him and his family was forwarded. In this way, their right to privacy was violated. It is not pleasant for someone else to have their personal data, especially some financial indicators about them, and because of that, everyone felt uneasy. They were afraid that someone might break into them or ask them for some financial racket. After this happened, he withdrew funds from both of those contracts and terminated the contracts. And this is precisely because of what happened to them. He states that no one should be able to see who the owner of the custody account is. The bank then changed the way in which the amounts in the account and other data can be viewed because before it was enough to open the bank's website and the data could be viewed there, and after this situation it was necessary to enter the OIB. Before this situation, monthly reports were also sent to them via e-mail, however, after this bank error, they were also sent via e-mail, but in order to open the document or report, the OIB had to be entered, which he does not consider sufficient protection. He states that he did not close only one custody account, and that was only because if he closed it now, he would receive a smaller amount, and he terminated the others, by going to the bank a few months after this happened and submitting a request to terminate the contract. He is still a client of the bank, receives his pension through it, and has made some transactions through the bank this year. He still has an eZaba contract through which he can view the account balance. He states that he has not suffered any material damage due to the bank's error, nor has he had any unpleasant experiences in the sense that someone would contact him regarding the bank's omission.9. The right to privacy is a personal non-property right that gives a person complete private legal authority to conduct his own life as well as the authority to exclude anyone else from unlawful interference with it. In a narrower sense, the right to privacy also includes the right to confidentiality of letters and other personal data, which includes the authority to exclude anyone else from unauthorized discovery, collection, further dissemination and publication of personal data, except for those who have been given consent and the authority to collect or process the said data. Therefore, in a situation where a bank entrusted with such authority acts contrary to contractual and legal provisions and, without the plaintiff's consent, transfers his personal data and banking secrets to other persons, the said conduct constitutes an unauthorized interference with the plaintiff's right to privacy. Accordingly, the court concludes that the defendant's actions caused the plaintiff non-property damage in the form of a violation of the said right.9.1. In order to assess whether it is justified to award fair compensation to the plaintiff in this case, the court assessed the gravity of the violation of rights and the circumstances of the case. In this case, the defendant did not provide the court or the plaintiff with a specific e-mail that was sent incorrectly so that they could verify the exact content of what was sent to third parties. Despite the defendant's claims that a monthly report on custody accounts was sent to the address of a third party, the principal, the court cannot determine on the basis of the above whether this is indeed the case. Finally, even the principal's confirmation that he deleted the received e-mail does not in itself prove that he did so and that the said content has not already gone further. It is precisely for this reason that the court considers this violation of privacy to be more serious for the plaintiff because he is unaware of the exact content of the personal data and banking secrets that were sent incorrectly, as well as the persons to whom the said content was made available, which is why he is still uncertain about the consequences that may arise as a result. 9.2. When deciding on the amount of fair compensation, the court took into account the severity and duration of the mental pain and fear caused by the injury, the purpose served by the compensation, but also that it does not favor aspirations that are incompatible with its nature and social purpose. In this sense, the court accepts the plaintiff's statement as true, convincing and logical, especially in the part in which he states that he is not comfortable that someone else has their personal data, especially some financial indicators about them, and that this made everyone feel uneasy, that they were afraid that someone might break into them or seek some financial racket. Bearing in mind the circumstances that affect the amount of compensation awarded, as well as other circumstances of the case, the court particularly appreciated the fact that the defendant is a financial and credit institution to which the plaintiff entrusted the management of its accounts and other financial resources and from which a higher level of professionalism and due care is required in the conduct of its business. Accordingly, this court considers that the plaintiff is entitled to fair monetary compensation in the total amount of EUR 3,500.00 for the non-pecuniary damage suffered due to the violation of the right to privacy. 9.3. Finally, it should be noted that the court's conclusion is not influenced by the defendant's allegations that the plaintiff has not completely lost confidence in the defendant's business because he is still a client of the bank, since the plaintiff's statement indicates that one custody account was terminated, which indicates a change in the plaintiff's relationship with the defendant, because the above does not mean that the plaintiff did not suffer damage as a result of the defendant's actions. 10. On the above-awarded amount of compensation for non-pecuniary damage, the plaintiff was awarded default interest from the date of filing the claim for compensation (February 10, 2023) until payment, in accordance with the provisions of Article 1103 of the ZOO. The rate was determined by applying the provisions of Article 29, paragraph 2 of the ZOO. 11. Accordingly, the court accepted the claim as well-founded on the basis of the provisions of Article 19 and 1100 of the ZOO.12. In accordance with the provisions of Articles 155 and 154, paragraph 1 of the ZPP, the plaintiff is entitled to compensation for litigation costs pursuant to the provisions of TNo. 7., 8., 9., 46. Tariffs on fees and reimbursement of expenses for the work of lawyers (Official Gazette, No. 138/23), according to the cost estimate submitted at the hearing held on 10 October 2025, and the value of the subject matter of the dispute, namely for the composition of the claim for damages in the amount of 200.00 euros, the composition of the lawsuit in the amount of 200.00 euros (Tbr. 8.1. Tariffs), for representation by proxy at the hearings on 9 July 2024 and 10 October 2025, each in the amount of 200.00 euros (Tbr.9.1. Tariffs), for representation at the hearings on 13 November 2024 and 8 April 2025, each in the amount of 100.00 euros (Tbr.9.2.), a total of 1,000.00 euros, which increased by VAT (25%) amounts to EUR 1,250.00. In accordance with the provisions of the Tariff of Court Fees contained in the Court Fees Act (Official Gazette, No.: 118/18 and 51/23), the plaintiff is entitled to a court fee of EUR 40.73 for the claim and EUR 81.45 for the judgment.13. Accordingly, in accordance with the provisions of Art. 154, paragraph 1 of the Civil Procedure Code, the defendant is ordered to compensate the plaintiff for the total cost of the proceedings in the amount of EUR 1,372.18 together with default interest pursuant to the provisions of Art. 151, paragraph 3 of the Civil Procedure Code at the rate determined in Art. 29, paragraph 2 of the ZOO, as decided in point II. of the dictum. In Zagreb, 5 December 2025. Judge: dr. sc. Dijana VragovićInstruction on legal remedy:A party dissatisfied with this judgment has the right to appeal within 15 days from the date of publication of the judgment. The appeal shall be submitted to this court in writing, and the appeal shall be decided by the county court.DNA:- full.parties