US Zagreb - Us I-451/2025-10
From GDPRhub
| US Zagreb - Us I-451/2025-10 | |
|---|---|
 | |
| Court: | US Zagreb (Croatia) |
| Jurisdiction: | Croatia |
| Relevant Law: | Article 6(1)(f) GDPR Article 17(1) GDPR Article 17(3)(a) GDPR |
| Decided: | 21.05.2026 |
| Published: | 06.06.2026 |
| Parties: | |
| National Case Number/Name: | Us I-451/2025-10 |
| European Case Law Identifier: | |
| Appeal from: | AZOP (Croatia) UP/I-009-01/24-03/34 |
| Appeal to: | Unknown |
| Original Language(s): | Croatian |
| Original Source: | Tražilica odluka sudova RH (in Croatian) |
| Initial Contributor: | ds |
A court held that a media outlet lawfully rejected an erasure request regarding articles involving a board member of a city-owned company. According to the court, the public interest justified the article’s continued availability.
English Summary
Facts
In 2022, a Croatian media outlet published articles about a person (data subject) who was, at the time, a member of the management board of Zagrebački holding d.o.o, a City of Zagreb-owned holding company providing municipal and utility services. The articles disclosed their name, the company where they were employed, their position, gross salary, the model of their personal vehicle, the gross monthly allowance for using a private vehicle, and the amount of a fine imposed by the Croatian Commission for the Resolution of Conflicts of Interest. The data subject held the management board position from September 2021 to March 2023.
The data subject lodged a complaint with the Croatian DPA, alleging that the publication infringed their right to the protection of personal data and requesting the removal of the articles.
The DPA rejected the complaint and found no violation. It concluded that the published personal data were appropriate, relevant and necessary for informing the public, due to the data subject’s position at the time of publication and because the public interest prevailed.
The DPA also found that the public interest in the continued availability of the articles outweighed the data subject’s request for erasure under Article 17 GDPR. It pointed out that Article 17(3)(a) GDPR stipulates that the right to erasure does not apply to the extent that the processing is necessary for the exercise of the right to freedom of expression and information.
The DPA considered the Croatian Media Act, noting that it applied as a special law. The Act regulates conditions for media freedom, the rights of journalists and access to public information. The DPA determined that according to Article 8 of the Media Act, there was no violation of the right to privacy if a legitimate public interest prevailed over the protection of privacy in relation to journalistic activities.
The data subject contested the DPA’s decision before the Administrative Court of Zagreb. They argued that they were not a public figure, that they no longer held any public position after 1 April 2023, and that the continued availability of the articles damaged their reputation and met the conditions for erasure under Article 17 GDPR.
The media outlet stated that all published information about the data subject was obtained from publicly available sources, as they were subject to proceedings by the Commission for the Resolution of Conflicts of Interest and had also been published by the city-owned company. The media outlet argued that the case involved information of significant public interest due to the fact that they concerned an investigation that revealed misconduct of a person in a public position, who was in fact fined for that reason. They further stated that the Croatian Constitution and the Media Act granted the media the right to freely report on such information.
Holding
Regarding the initial publication, the court held that the Croatian Media Act served as a legal basis for the processing of personal data under Article 6 GDPR. It found that since the data subject had performed a public duty as a member of the management board of a city-owned company, the public interest in being informed prevailed over the protection of their personal data. The media outlet therefore had the right to publish information containing personal data to the extent that the data were relevant and necessary to achieve the purpose established by law.
Regarding the removal of the articles, the court held that the DPA had correctly found that there was still a relevant legal basis for the continued processing of the data under Article 6(1)(f) GDPR. It confirmed that the public interest continued to prevail, thereby justifying the continued availability of the data subject’s personal data in the articles for the purpose of public disclosure by the media.
It further upheld that the conditions for erasure under Article 17 GDPR were not met, in light of the Article 17(3)(a) GDPR exception for the exercise of freedom of expression and information.
The court dismissed the appeal and upheld the DPA’s decision. It also awarded €1,250 in costs to the media outlet.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.
Republic of Croatia Administrative Court in Zagreb Zagreb, Avenija Dubrovnik 6 and 8 Case number: Us I-451/2025-10 IN THE REPUBLIC OF CROATIA JUDGMENT Administrative Court in Zagreb, by the individual judge of that court Maja Valušnig, with the participation of the recorder Mateja Marjanović, in the administrative dispute of the plaintiff ČČ, from [address], OIB: [personal identification number], represented by the authorized representative Ana Glowatzky Sesar, attorney in Zagreb, Ksaverska cesta 35a, against the defendant Agency for the Protection of Personal Data from Zagreb, Ulica Metela Ožegovića 16, OIB: 28454963989, with the participation of the interested party Večernji list d.o.o. Zagreb, Oreškovićeva 3d, OIB: 92276133102, represented by attorneys CČ and MČ from the Law Firm Ladan i Krmpotić d.o.o. Zagreb, Metalčeva ulica 5, for the right to protection of personal data, after an oral and public hearing, on 21 May 2026, the judgment is hereby dismissed. The claim for annulment of the decision of the defendant of the Personal Data Protection Agency of the Republic of Croatia, CLASS: UP/I-009-01/24-03/34, REGISTRATION NUMBER: 567- 04-02/02-24-1 of 15 November 2024, is hereby dismissed. II The plaintiff's claim for reimbursement of the costs of the administrative dispute is hereby dismissed as unfounded in its entirety. III The plaintiff is ordered to reimburse the costs of the administrative dispute to the interested person in the amount of EUR 1,250.00 within 15 days from the date of delivery of this judgment. Reasoning 1. The contested decision of the defendant of the Personal Data Protection Agency of the Republic of Croatia, CLASS:UP/I-009-01/24-03/34, NUMBER:567-04-02/02-24-1 of 15 November 2024, rejected the plaintiff's request for a determination of a violation of the right to protection of personal data.2. In the lawsuit and during the proceedings, the plaintiff disputes the legality of the defendant's decision due to the incorrectly and incompletely established state of facts, the incorrect application of substantive law and significant violations of the rules of procedure. He points out that articles/videos were published on the websites of 20 newspaper portals, as well as on the Youtube platform, in which allegations were made that were not published in accordance with the General Regulation on the Protection of Personal Data. He states that there are 45 links through which one can access publications about the plaintiff, and which publications contain data that are not of public interest, since this is information in respect of which the public interest does not prevail over the protection of the privacy of any natural person. He claims that the available publications on the internet relate to the plaintiff's private car of the "Tesla" brand and to the plaintiff's income as a member of the board of Zagrebački holding d.o.o. at the time. He points out that the plaintiff did not hold any function that makes him a public person and whose personal data and private life have grounds to be available to the public, especially not now when he does not hold any function in public life nor has he held any public function in social or political life since 1 April 2023. In relation to his position as a member of the board of ZAGREBAČKI HOLDING d.o.o., he states that he was a member of the board from 3 September 2021 to 31 March 2023. In addition, the plaintiff states that he was never a member of any political party, and all the jobs he performed include jobs and positions that are closely related to the plaintiff's completed education (he graduated from the Faculty of Economics in Zagreb on 23 May 1997). It points out that since the plaintiff is not a public figure, nor a member of any political party, while the disputed publications were made while he was a member of the management board of Zagrebački holding d.o.o., but in relation to his personal data relating to his private car of the brand "Tesla", as well as to the highlighting of the plaintiff's income as a member of the management board of Zagrebački holding d.o.o., they do not justify the public interest and do not represent data that are at all relevant or necessary for any achievement of the purpose established by law, and that the said publications, which, in addition to being untrue, do not serve and do not need to be transparent to the general public, except that they damage the reputation of the plaintiff, as a result of which it considers that the condition for the removal of the said articles within the meaning of Art. 17 of the Regulation has been met, and that the condition of the right to be forgotten has been met. It points out that the published information containing personal data in the disputed (subject articles) causes damage to the plaintiff, and that the same data violates the plaintiff's right to personality, especially because the said data is incorrect and there is no public interest in them. It states that at the time when the plaintiff addressed the defendant with the request of 22 April 2024 to delete the disputed articles, he was a private person, did not perform any public function and for more than a year was unable to find employment despite his expertise, abilities and qualifications. Given the passage of time, and even if the information provided was accurate at the time of publication of the articles, he considers that it has now become pointless and unnecessary. It refers to the decision of the European Court of Human Rights, application number 11058/24 of 12 March 2026, which refers to the sentence imposed by the Commission for Deciding on Conflicts of Interest of 09 September 2022, by which decision it was established that the plaintiff's rights were violated, and that it was not based on law.2.1. It proposes to the court to annul the contested decision and accept the plaintiff's request for establishing a violation of the right to the protection of personal data.3. In its response to the complaint and throughout the proceedings, the defendant fully maintains the allegations made in the explanation of the contested decision. The defendant specifically states that the plaintiff in no way disputed the accuracy of the personal data published by the media in the disputed articles, from which it is undoubtedly clear that the information published by the media, i.e. their personal data, is accurate, all taking into account Article 5. 1. d) of the GDPR. The defendant emphasizes that the decision of the European Court of Human Rights (hereinafter: the ECtHR) referred to by the plaintiff is not legally decisive for resolving this administrative dispute, since it is clear from the reasoning of the said decision that it relates exclusively to the violation of the right to a fair trial under Article 6, paragraph 1 of the Convention for the Protection of Human Rights and Fundamental Freedoms (hereinafter: the Convention) from the aspect of the principle of equality of arms in the proceedings before the High Administrative Court of the Republic of Croatia, and that it clearly follows from the reasoning of the decision that the court did not enter into a substantive assessment of the factual and legal issues that were the subject of domestic proceedings, nor did it assess the legality of the decision of the Commission for Deciding on Conflicts of Interest, nor the truthfulness of the facts that were the subject of public reporting. On the contrary, it states that the proceedings before the ECtHR were concluded by accepting the unilateral statement of the defendant state and striking the case out of the list in accordance with Article 37, paragraph 1, point (c) of the Convention. 3.1. It proposes that the court dismiss the claim. 4. In his response to the complaint, the interested party disputes the claim in its entirety, citing the reasons from the contested decision. He believes that the plaintiff chose the wrong legal path regarding his dissatisfaction with the publication of information about his salary and the use of a car for work purposes, drawing attention to the fact that the Media Act prescribes and regulates legal relations and procedures related to the publication of information in the media. In other words, a person who believes that some of his rights have been violated by the fact of publishing certain information in the media, and according to the complaint, this is precisely the subject of these proceedings, has at his disposal numerous legal actions and options against the editor-in-chief and/or publisher of the media, which institutes are regulated by the Media Act. Given this, he believes that the plaintiff should have acted in accordance with the provisions of the Media Act and ultimately tried to exercise his rights before the competent municipal court and not through the Personal Data Protection Agency and the administrative court. He points out that the information on his name and surname, the company he is employed by, his position, his salary, salary compensation and all other personal information stated in the articles in question were obtained from publicly available sources, since they were the subject of proceedings by the Commission for Deciding on Conflicts of Interest and were published by Zagrebački holding itself (information on salary and salary compensation). Moreover, given that the Commission for Deciding on Conflicts of Interest found irregularities in the performance of the plaintiff's function and imposed a fine on him, he believes that it is clear that in the above case the information was of great interest to the public, which should have been informed about the above-mentioned inappropriate actions of a person holding a public position. He states that the Constitution and the Media Act and the Electronic Media Act allow, enable and guarantee the right of the media publisher, the interested person, to freely report on the above-mentioned information that is disputed by the plaintiff.4.1. He proposes that the court reject the claim.5. The claim is unfounded.6. The court held an oral and public hearing in the presence of the plaintiff's attorney and the defendant's attorney, in the absence of the duly summoned interested person, based on the authority provided in Article 89, paragraph 4 of the Administrative Disputes Act (Official Gazette, No. 36/24), of which the parties were warned in the summons to the hearing.7. Assessing the legality of the contested decision and considering the disputed factual and legal issues, the court reviewed the court file and the defendant's file attached to the response to the lawsuit.8. Upon review of the contested decision of 15 November 2024, it was determined that the plaintiff's request for a declaration of a violation of the right to protection of personal data was rejected, with the explanation that in this administrative matter it was determined that there was no violation of the plaintiff's rights, all in accordance with Articles 5 and 6 of the General Data Protection Regulation, that the scope of the applicant's personal data published by the publication in question is appropriate, relevant and limited, i.e. necessary in relation to the purposes for which the personal data were processed/published (Article 5, paragraph 3 of the General Data Protection Regulation). Furthermore, the defendant determined that the plaintiff's arguments are unfounded, i.e. that Article 7 of the Media Act applies. In the specific case, the defendant determined that the media published information during 2022 that, among other things, also related to the personal data of the plaintiff, who at that time was a member of the management board of Zagrebački holding d.o.o.(September 3, 2021-March 31, 2023), since the plaintiff performed a public service/duty (member of the board) for a certain period, from which it follows that informing the public, i.e. the public interest prevailed over the protection of personal data. Regarding the removal of the aforementioned articles, the defendant established that there is still a relevant legal basis for processing them within the meaning of Article 6, paragraph 1, item 6 of the General Data Protection Regulation, i.e. the public interest still prevails, which directly includes the justification for the availability of his personal data in the articles in question. The defendant concludes that in the specific case the published information/personal data is still necessary in relation to the purpose of the public disclosure by the media, and that the condition for the right to remove the aforementioned articles within the meaning of Article 17 of the General Data Protection Regulation (right to be forgotten) has not been met. 9. Article 5.1.b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the General Data Protection Regulation) Official Journal of the European Union L 119 stipulates that personal data must be collected for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes (purpose limitation principle). 10. Article 6.1. of the General Data Protection Regulation exhaustively lists the possible legal bases/conditions for the lawful processing of personal data. Thus, the aforementioned article stipulates that the processing of personal data is lawful only if and to the extent that at least one of the following is met: the data subject has given consent to the processing of his or her personal data for one or more specific purposes, the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the data subject's request prior to entering into a contract, the processing is necessary for compliance with the controller's legal obligations, the processing is necessary to protect the vital interests of the data subject or another natural person, the processing is necessary for the performance of a task carried out in the public interest or in the exercise of the controller's official authority, the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.11. The provision of Article 17, paragraph 1, point a) of the General Data Protection Regulation stipulates that the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase personal data without undue delay if one of the following conditions is met: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.12. Paragraph 3, point 1 of the aforementioned Article stipulates that paragraphs 1 and 2 shall not apply to the extent that the processing is necessary for the exercise of the right to freedom of expression and information;13. In this specific case, the Media Act (Official Gazette, No. 59/04, 84/15, 81/13 and 114/22) is applied as a special law, which, among other things, regulates the prerequisites for the realization of the principle of freedom of the media, the right of journalists and other participants in public information to freedom of reporting and access to public information, the rights and obligations of publishers, and the realization of the right to correction and reply.14. Article 3 of the cited Act states that freedom of expression and freedom of the media are guaranteed, which includes, among other things, freedom of expression of opinion, independence of the media, freedom to collect, research, publish and disseminate information for the purpose of informing the public, access to public information and respect for the protection of human personality, privacy and dignity.15. Also, Article 7, paragraph 1 of the Media Act stipulates that every person has the right to the protection of privacy, dignity, reputation and honour. Article 7, paragraph 2 of the Media Act stipulates that a person performing a public service or duty has the right to protection of privacy, except in cases related to the public service or duty that the person performs. A person who, by his or her statements, conduct and other acts relating to his or her personal or family life, attracts public attention cannot claim the same level of privacy protection as other citizens (Article 7, paragraph 3 of the Media Act).16. There is no violation of the right to privacy protection if, with regard to information, a legitimate public interest prevails over the protection of privacy in relation to the journalist's activity or to the information (Article 8 of the Media Act).17. The information in the file shows that on August 3, 2022 and September 9, 2022, the interested party published journalistic articles entitled "With a gross salary of 32,400 kuna per month, he also uses a company car", "Member of the Management Board of the Holding Fined 8,000 kuna for Prohibited Compensation for Č" and "MEMBER OF THE MANAGEMENT BOARD OF THE ZAGREB HOLDING, The Commission Fined Sesar 8,000 kuna for Unpermitted Compensation for Č", which are publicly available via links. Furthermore, during the proceedings, it was determined that the personal data of the applicant were published in the following scope: name and surname, name of the company in which he is employed, function he holds, information on income - gross salary, make of personal car, information on the monthly compensation for the use of a private car - gross amount and information on the amount of the fine ordered by the Commission for Deciding on Conflicts of Interest.18. Assessing the legality of the contested act in the above-mentioned part from the aspect of the highlighted allegations of the complaint, the court finds no violation of the law to the detriment of the plaintiff.19. Based on the content of the case file and the cited legal regulations, this court assesses that the defendant body correctly determined that there was no violation of the right to the protection of personal data.20. Namely, in the opinion of this court, in this specific case, the Media Act constitutes the legal basis for the processing of personal data in accordance with Article 6 of the General Data Protection Regulation. Accordingly, the interested person as a media outlet has the right to publish information that may contain personal data to the extent that is relevant/necessary for achieving the purpose established by law. The Media Act constitutes the legal basis for the processing of personal data in accordance with Article 6 of the General Data Protection Regulation. Accordingly, the publication in question as a media outlet has the right to publish information that may contain personal data to the extent that is relevant/necessary for achieving the purpose established by law. Since the plaintiff was a member of the management board of Zagrebački holding d.o.o. at that time (September 3, 2021-March 31, 2023). he performed a public service/duty (member of the management board) for a certain period, from which it follows that informing the public, i.e. the public interest prevailed over the protection of personal data21. Regarding the removal of the aforementioned articles, this court considers that the defendant correctly determined that there is still a relevant legal basis for their processing within the meaning of Article 6, paragraph 1, item 6 of the General Data Protection Regulation, i.e. the public interest still prevails, which directly includes the justification for the availability of his personal data in the articles in question, that the published information/personal data is still necessary in relation to the purpose of public disclosure by the media, and that the condition for the right to remove the aforementioned articles within the meaning of Article 17 of the General Data Protection Regulation (right to be forgotten), and in accordance with Article 17, paragraph 3 of the General Data Protection Regulation (exception to the application of the right to be forgotten in which case the processing is necessary for the exercise of the right to freedom of expression and information), has not been met.22. In relation to the decision of the European Court of Human Rights in question, application number 11058/24 of 12 March 2026, to which the plaintiff refers, upon examination of the same it was established that the court did not enter into a substantive assessment of the factual and legal issues that were the subject of domestic proceedings, nor did it assess the legality of the decision of the Commission for Deciding on Conflicts of Interest, nor the truthfulness of the facts that were the subject of public reporting, but rather it was only a violation of procedural rules (the High Administrative Court of the Republic of Croatia did not submit a response to the complaint to the plaintiff for comment).23. Following all of the above, the court dismissed the complaint as unfounded, based on Article 116, paragraph 1 of the Administrative Disputes Act.24. The plaintiff's request for reimbursement of the costs of the administrative dispute was dismissed as unfounded, based on the provision of Article 147, paragraph 1 of the Administrative Disputes Act, since he lost the dispute in its entirety.25. The interested party was awarded the cost of representation by an attorney for the preparation of a response to the complaint in the amount of 1,250.00 Euros (Tbr. 27/1 in connection with Tbr. 46) in view of the complete success in the dispute, pursuant to Article 147 of the Administrative Disputes Act and the provisions of the Tariff on Awards and Reimbursement of Costs for the Work of Attorneys (Official Gazette, No. 138/23 and 107/25). In Zagreb, 21 May 2026. Judge Maja Valušnig INSTRUCTIONS ON LEGAL REMEDY: An appeal against this judgment is permitted to the High Administrative Court of the Republic of Croatia. The appeal shall be filed through this court in a sufficient number of copies for the court and all parties to the dispute, within 15 days from the date of delivery of the judgment. DNA: 1. to the plaintiff via e-mail 2. Agency for the Protection of Personal Data of the Republic of Croatia, Zagreb, Ulica Metela Ožegovića 163. to the interested person via e-communication4. In the file
