CroatiaElectronic Communications Act (Zakon o elektroničkim komunikacijama), Article 43, Paragraph 4, Consent for Storing or Accessing Data in Terminal Equipment
Čl. 43. st. 4. Zakona o elektroničkim komunikacijama
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Obtain the end user's or user's consent before using an electronic communications network to store data in their terminal equipment or to access data already stored there, after giving clear and complete notice in line with personal data protection rules, in particular about the purposes of the processing (article 43, paragraph 4).
- No consent is needed for technical storage or access solely to carry out the transmission of communications over an electronic communications network or, where necessary, to provide an information society service at the express request of the end user or user (article 43, paragraph 4).
These lines are LexLint's reading of the law's text, as of . Also read by: Agencija za zaštitu osobnih podataka (AZOP) (guidance, recorded ); Case C-673/17 Planet49, judgment of the Court of Justice of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
Article 170, paragraph 1 fines a legal person EUR 13,270 to EUR 132,720, paragraph 2 the responsible person in it EUR 2,650 to EUR 13,270, and paragraph 3 a natural person EUR 1,320 to EUR 6,630.
- Rule
- Fixed only
- As of
- Minimum
- 13,270
- Currency
- EUR
- Fixed cap
- 132,720
Who enforces it
Enforcement body
The Agency (Agencija), the Croatian Regulatory Authority for Network Industries, or the authority competent for personal data protection may order an end to breaches of articles 41 to 50 (article 51, paragraph 1).
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673
- Guidance link
- https://azop.hr/obrada-osobnih-podataka-kolacici/
- Case citation
- Case C-673/17 Planet49, judgment of the Court of Justice of
- Guidance body
- Agencija za zaštitu osobnih podataka (AZOP)
What this law does
Article 43, paragraph 4 of the Electronic Communications Act (Zakon o elektroničkim komunikacijama) allows using electronic communications networks to store data, or to access data already stored, in the terminal equipment of an end user or user only where that end user or user has consented after receiving clear and complete notice, in line with personal data protection rules, in particular about the purposes of the processing.
Article 43, paragraph 4 does not prevent technical storage or access solely to carry out the transmission of communications over an electronic communications network, or, where necessary, to provide an information society service at the express request of the end user or user.
Article 170, paragraph 1 punishes a legal person that uses an electronic communications network to store data or access stored data in terminal equipment without the end user's consent or without clear and complete notice with a fine of EUR 13,270 to EUR 132,720 as a misdemeanor. Article 170, paragraphs 2 and 3 fine the responsible person in the legal person EUR 2,650 to EUR 13,270 and a natural person EUR 1,320 to EUR 6,630 for the same misdemeanor.
Article 51, paragraph 1 lets the Agency (Agencija) or the authority competent for personal data protection order an end to breaches of articles 41 to 50. Article 7, paragraph 1 makes the Croatian Regulatory Authority for Network Industries (Hrvatska regulatorna agencija za mrežne djelatnosti, the Agency) the national regulatory authority. Article 29 of the amending Act NN 45/2026 renumbers the points of article 170, paragraph 1 that list these breaches.
Article 187 provides that the Act takes effect on the eighth day after its publication, except articles 169 to 172, which take effect on the day the euro is introduced.
When LexLint raises it
When your app profile says your app tracks devices.