CroatiaElectronic Communications Act (Zakon o elektroničkim komunikacijama), Article 50, Paragraphs 1 to 4, Unsolicited Electronic Communications
Čl. 50. st. 1.-4. Zakona o elektroničkim komunikacijama
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
As of .
What it requires
- Use automatic calling and communication systems without human intervention, fax machines or electronic mail, including SMS and MMS messages, for direct promotion and sale only with the end user's prior consent (article 50, paragraph 1).NIST Privacy FrameworkCT.PO-P1
- You need no prior consent to market your own similar products or services by electronic mail to consumers whose addresses you obtained in connection with selling products or services, but you must give them a clear and unambiguous, free and simple chance to object when you collect the addresses and with every electronic message, unless they have already refused (article 50, paragraph 2).NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Do not send promotional or sales electronic mail, SMS or MMS messages that misrepresent or conceal the sender's identity or are contrary to the rules on electronic commerce, that lack a valid address or number to which the recipient can send a request to stop further communication free of charge, or that urge recipients to visit websites contrary to the rules on electronic commerce (article 50, paragraph 3).NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Paragraphs 1 and 2 do not apply to such communication addressed to legal persons (article 50, paragraph 4).
These lines are LexLint's reading of the law's text, as of . Also read by: Agencija za zaštitu osobnih podataka (AZOP) (guidance, recorded ); Court of Justice, judgment of , Inatais, C-654/23 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
Article 170, paragraph 1 fines a legal person EUR 13,270 to EUR 132,720, paragraph 2 the responsible person in it EUR 2,650 to EUR 13,270, and paragraph 3 a natural person EUR 1,320 to EUR 6,630.
- Rule
- Fixed only
- As of
- Minimum
- 13,270
- Currency
- EUR
- Fixed cap
- 132,720
Who enforces it
Enforcement body
The Agency (Agencija), the Croatian Regulatory Authority for Network Industries, or the authority competent for personal data protection may order an end to breaches of articles 41 to 50 (article 51, paragraph 1).
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0654
- Guidance link
- https://azop.hr/preporuka-za-provedbu-testa-legitimnog-interesa-prema-clanku-6-stavku-1-tocki-f-opce-uredbe-o-zastiti-podataka/
- Case citation
- Court of Justice, judgment of , Inatais, C-654/23
- Guidance body
- Agencija za zaštitu osobnih podataka (AZOP)
- Open questions
- Does a communication sent to the business electronic mail address of a named employee of a legal person fall within "prema pravnim osobama" in Article 50, paragraph 4 of the Electronic Communications Act, so that the prior consent rule in paragraph 1 does not apply to it?
What this law does
Article 50, paragraph 1 of the Electronic Communications Act allows the use of automatic calling and communication systems without human intervention, fax machines or electronic mail, including SMS and MMS messages, for direct promotion and sale only with the end user's prior consent.
Article 50, paragraph 2 lets a natural or legal person who is a trader use the electronic mail addresses it obtained from its consumers in connection with selling products and services for direct promotion and sale of its own similar products or services only, if those consumers have a clear and unambiguous, free and simple chance to object when the addresses are collected and with every electronic message, where the consumer has not already refused.
Article 50, paragraph 3 bans, for direct promotion and sale, sending electronic mail or SMS and MMS messages that misrepresent or conceal the sender's identity and are contrary to the rules on electronic commerce, sending them without a valid address or number to which the recipient can send a request to stop further communication free of charge, and sending messages that urge recipients to visit websites contrary to the rules on electronic commerce.
Article 50, paragraph 4 provides that paragraphs 1 and 2 do not apply to such communication addressed to legal persons. Article 170, paragraph 1 punishes a legal person that uses automatic calling or communication systems, fax or electronic mail for direct promotion or sale without the end user's prior consent, uses consumers' electronic mail addresses without a free and simple way to object, or sends the prohibited messages with a fine of EUR 13,270 to EUR 132,720 as a misdemeanor.
Article 170, paragraphs 2 and 3 fine the responsible person in the legal person EUR 2,650 to EUR 13,270 and a natural person EUR 1,320 to EUR 6,630 for the same misdemeanor. Article 51, paragraph 1 lets the Agency (Agencija) or the authority competent for personal data protection order an end to breaches of articles 41 to 50.
Article 7, paragraph 1 makes the Croatian Regulatory Authority for Network Industries (Hrvatska regulatorna agencija za mrežne djelatnosti, the Agency) the national regulatory authority. Article 29 of the amending Act NN 45/2026 renumbers the points of article 170, paragraph 1 that list these breaches. Article 187 provides that the Act takes effect on the eighth day after its publication, except articles 169 to 172, which take effect on the day the euro is introduced.
When LexLint raises it
When your app profile says your app sends automated outreach.