US Rijeka - Us I-199/2025-9
From GDPRhub
| US Rijeka - Us I-199/2025-9 | |
|---|---|
 | |
| Court: | US Rijeka (Croatia) |
| Jurisdiction: | Croatia |
| Relevant Law: | Article 51 GDPR |
| Decided: | 13.11.2025 |
| Published: | 05.01.2026 |
| Parties: | |
| National Case Number/Name: | Us I-199/2025-9 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Croatian |
| Original Source: | US Rijeka (in Croatian) |
| Initial Contributor: | RP |
A court held that the DPA is required to investigate a data subject’s complaint and issue a decision on the merits. In the specific case, the court ordered the DPA to issue a decision regarding an alleged unlawful disclosure of personal data within 60 days.
English Summary
Facts
On 28 January 2025, the Croatian Personal Data Protection Agency (AZOP) dismissed a complaint from a data subject who alleged that an education inspector had disclosed his personal data to the principal of a music school in Rijeka. The data subject claimed that the inspector copied him on an email to the principal without his consent, revealing his identity and breaching the GDPR and the Croatian implementing act. AZOP rejected the complaint, stating that there were no legal grounds to open a procedure, without assessing whether the data subject’s rights had been violated. They argued that the data subject’s allegations were about breaches of sectoral rules governing inspections, not about GDPR violations and consequently they lacked competence. The data subject challenged this decision before the Administrative Court in Rijeka.
Holding
The Administrative Court in Rijeka annulled AZOP’s decision and sent the case back for reconsideration. The court held that AZOP could not rule on breaches of the Education Inspection Act or the inspector’s disciplinary responsibilities. However, as an independent supervisory authority under Article 51 GDPR, AZOP was competent and obliged to assess whether the data subject’s personal data had been unlawfully processed. The court found that AZOP should have examined the complaint on its merits rather than dismissing it on procedural grounds. The court required AZOP to establish the full facts, determine if unlawful processing occurred, and issue a substantive decision within 60 days. AZOP was ordered to reimburse the data subject €1,000 for legal costs while other cost claims were denied.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.
REPUBLIC OF CROATIAADMINISTRATIVE COURT IN RIJEKA[address] D 5Case number: Us I-199/2025-9IN THE NAME OF THE REPUBLIC OF CROATIAJUDGMENTThe Administrative Court in Rijeka, presided over by Judge Ana Sabljak, with the participation of DAŠ, in the administrative dispute of the plaintiff DA from [address], OIB: [personal identification number], represented by the authorized representative Zrinka Prlić, attorney in Zagreb, Kaptol 21, against the Personal Data Protection Agency, Zagreb, Ulica grada Vukovara 54, OIB: 28454963989, for the purpose of establishing a violation of the right to the protection of personal data, 13 November 2025,judgment by I. The defendant's decision CLASS: UP/I-009-01/25-13/1, NUMBER: 567- 04-02/10-25-1 of 28 January 2025 is annulled and the case is returned to the defendant for a new procedure in which he is obliged to act in accordance with the legal understandings and observations of the court expressed in the reasoning of this judgment.II. The defendant is ordered to reimburse the plaintiff for the costs of the administrative dispute in the amount of EUR 1,000.00 (one thousand euros), within 60 days from the date of delivery of the final decision on costs.III. The plaintiff's request for reimbursement of the costs of the dispute in the remaining amount of EUR 2,250.00 (two thousand two hundred and fifty euros) is rejected.Reasoning1. By the decision of the defendant CLASS: UP/I-009-01/25-13/1, REGISTRATION NUMBER: 567-04-02/10-25-1 of 28 January 2025 (pages 6/1-9/1 of the file), the plaintiff's request for a determination of a violation of the right to protection of personal data was rejected because there are no legal prerequisites for conducting the procedure.2. In the lawsuit, the plaintiff disputes the legality of the defendant's decision and argues that during the inspection at the Ivan Matetić Ronjgov Music School in Rijeka, the educational inspector revealed his identity to the school principal, which resulted in a violation of Art. 16, paragraphs 1, 2 and 4 of the Education Inspection Act and the General Data Protection Regulation, i.e. that the inspector sent an e-mail to the school principal, without his consent to the disclosure of personal data, in which she also marked the plaintiff as a copy ("cc"), which made his personal data (name and surname) visible to the principal. She refers to Articles 4 and 6 of the General Data Protection Regulation and Article 34, paragraph 1 of the Act on the Implementation of the General Regulation. She points out that the Education Inspection Act, the Civil Servants Act and the Code of Ethics of Civil Servants regulate the liability and disciplinary violations of civil servants, but do not exclude the possibility of separately establishing a violation of the right to protection of personal data of a citizen, just as the initiation of proceedings before the Ethics Commission of the Ministry of Justice, Administration and Digital Transformation does not diminish the plaintiff's right to request the establishment of a violation of personal data. He believes that in the specific case there was no legitimate basis for disclosing his identity to the school principal because such an action was not necessary for the performance of the official duties of the education inspector. He proposes to the court, without holding a hearing, to annul the contested decision of the defendant. 3. In his response to the complaint, the defendant disputes the complaint and the claim in its entirety. He states that since 25 May 2018, the General Regulation (EU) 2016/679 (GDPR) has been directly applicable, which ensures a uniform level of personal data protection in all EU Member States, and the Agency, in accordance with Article 51 of the General Regulation and Article 4 of the Act on the Implementation of the General Regulation, is an independent supervisory body responsible for monitoring and implementing that regulation. He points out that he is not competent to decide on possible violations of the Education Inspection Act, the provisions of which (Article 16, paragraphs 1, 2 and 4) the plaintiff refers to in his application. It indicates that the plaintiff himself revealed his identity when, in an e-mail dated 14 November 2024 at 8:14 a.m., sent to the Education Inspectorate, he copied (cc) the Head of the Piano Department and the Primorje-Gorski Kotar County, thereby making his personal data available to third parties. It points out that a respondent who publicly discloses his personal data cannot then request protection from their processing in a manner that would lead to a disproportionate burden on public law bodies (Article 4 of the General Regulation). The defendant acted within the limits of his powers under Article 58 of the General Regulation and Article 34 of the Act on the Implementation of the General Data Protection Regulation. It proposes that the court dismiss the claim.4. The court decided to resolve this dispute without a hearing (Article 98, item 4 of the Administrative Disputes Act, Official Gazette No. 36/24; hereinafter: ZUS, in connection with Article 8 of that Act). The plaintiff also stated that he did not request a hearing.5. The court conducted the evidentiary procedure by reading the documentation contained in the file of this administrative dispute and the file of the administrative proceedings that preceded this dispute.6. Based on the consideration of all factual and legal issues, in accordance with the provision of Article 114, paragraph 3 of the ZUS, the court found that the claim was well-founded.7. According to the provision of Article 51, paragraph 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the General Data Protection Regulation (hereinafter: the General Regulation), each Member State shall ensure the existence of one or more independent public authorities responsible for monitoring the application of that Regulation in order to protect the fundamental rights of natural persons with regard to the processing of personal data.8. In accordance with the provision of Article 4. Paragraph 1. of the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/18; hereinafter: the Act on the Implementation of the General Data Protection Regulation) the Personal Data Protection Agency (the defendant) performs the tasks of an independent supervisory body referred to in Article 51 of the General Regulation.9. It follows from the above that the defendant's jurisdiction is limited to the application of the regulations on the protection of personal data, i.e. to the determination of violations of the rights guaranteed by the General Regulation, and does not include the examination of the conduct of civil servants within the framework of special administrative procedures prescribed by other laws.10. Therefore, the defendant correctly established that it is not competent to decide on the alleged violations of the provisions of Article 16. Paragraphs 1, 2 and 4 of the Education Inspection Act (Official Gazette 61/11, 16/12, 98/19, 52/21; hereinafter: the Education Inspection Act) to which the plaintiff refers.11. Furthermore, according to the provision of Article 38. para. 2. of the Education Inspection Act, no one may order, prevent or obstruct an inspector in carrying out supervision and taking measures and actions for which he is authorized. This provision ensures the independence of the inspector in performing his official duty, which means that the defendant cannot supervise or evaluate the work of the education inspector or make decisions that would interfere with her authority to conduct supervision, as the defendant herself states.12. The provision of Art. 13. para. 2. of the Education Inspection Act prescribes the data from the application that are used for the purpose of conducting inspection supervision and the aforementioned provision constitutes the legal basis for the processing of the personal data of the applicant by the education inspection.13. According to the provision of Art. 6. para. 1. t. (e) of the General Regulation, processing is lawful if it is necessary for the performance of a task in the public interest or in the exercise of the official authority of the controller. Additionally, the provision of Art. Article 6(3) of the same Regulation stipulates that the legal basis for such processing shall be determined in the law of the Member State. In the specific case, the Education Inspection Act constitutes this national legal basis (Article 13).14. However, following these findings, the defendant did not act lawfully when it rejected the plaintiff's request by referring to Article 41 of the General Administrative Procedure Act (Official Gazette, No. 47/09, 110/21; hereinafter: the ZUP).15. Namely, the provision of Article 41(1) of the ZUP stipulates that a public law body shall reject the request by decision when an official determines that there are no legal prerequisites for initiating the procedure.16. Although the defendant correctly pointed out that it is not competent to decide on violations of the Education Inspection Act, as an independent supervisory body within the meaning of Article 51 of the General Data Protection Regulation and Article 4 of the Act on the Implementation of the General Regulation, is competent to decide on violations of the rights of the data subjects guaranteed by the aforementioned regulations.17. Since the plaintiff in the request pointed out a violation of the right to protection of personal data, the defendant was obliged to decide on the merits, i.e. if it considered that no violation had been established, to reject the request as unfounded, and not to dismiss it for procedural reasons with the explanation that there are no prerequisites for conducting the dispute.18. In accordance with the above, the contested decision could not be assessed as lawful for the time being. Therefore, the court accepted the claim and annulled the contested decision of the defendant, and returned the case for retrial (Art. 117, paragraph 1 of the ZUS). In the retrial, the defendant is obliged to make a decision within 60 days from the date of delivery of the final judgment (Art. 151, paragraph 2 of the ZUS), whereby he is obliged to act in accordance with the legal understandings and observations of the court (Art. 119, paragraph 4 of the ZUS). The defendant is obliged to fully establish the factual situation, assess whether there are elements of unlawful processing of personal data and make a decision on the merits of the plaintiff's request in accordance with Art. 98 of the ZUP. Consequently, it was decided as in point I of the operative part of the judgment.19. The court made a decision on the costs of the dispute (point II of the operative part of the judgment) based on the provisions of Art. 144, Art. 147, paragraph 1 and Art. 148, paragraph 1 of the ZUS. The plaintiff was successful in the dispute in which he was represented by an attorney-at-law, so he was awarded costs according to Tbr. 27/1 and Tbr. 52/3 of the Tariff on fees and compensation for attorneys' work (Official Gazette No. 138/23, 107/25; hereinafter: Tariff) for the preparation of a claim in the amount of EUR 1,000.00. The deadline for payment of the compensation for costs is determined in accordance with Article 151, paragraph 2 of the ZUS.20. In addition to the aforementioned cost, the plaintiff also requested compensation for the costs of preparing the submission of 14 April 2025 in the amount of EUR 1,000.00 and the submission of 8 September 2025 in the amount of EUR 1,250.00. However, in the opinion of this court, this is not a justified expense within the meaning of Article 144, paragraph 1 of the ZUS because the submissions mostly repeat allegations from the claim and they did not contribute to the outcome of this dispute and as such cannot be charged to the other party. Accordingly, in that part the plaintiff's request for compensation of costs was rejected as unfounded, i.e. it was decided as under item III. of the operative part of the judgment.21. Since the claim was not dismissed nor the claim was rejected, the plaintiff was not called upon to pay the court fee, in accordance with the provisions of Article 22, paragraph 1 of the Court Fees Act (Official Gazette, No. 118/18 and 51/23; hereinafter: ZSP). In Rijeka, 13 November 2025. Judge Ana Sabljak INSTRUCTIONS ON LEGAL REMEDY: An appeal against item I. of the operative part of the judgment is not permitted (Article 127, paragraph 1 of the ZUS). An appeal against items II.-III. of the operative part of the judgment is permitted to the High Administrative Court of the Republic of Croatia. The appeal shall be filed through this court, within 15 days from the date of receipt of the transcript of this judgment.
