CroatiaAZOP Enforcement and GDPR Article 82
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 146 of the Croatian Criminal Code (Kazneni zakon), Nedozvoljena uporaba osobnih podataka (unauthorized use of personal data), makes it an offense to collect, process, or use personal data of a natural person contrary to the conditions set by law, punishable by up to one year of imprisonment for the basic offense. The maximum rises to three years where the data is exported from Croatia for further processing, published, or otherwise made accessible, where the offender gains significant material benefit or causes significant damage, where the offense is committed against a child, or where the personal data processed is a special category (racial or ethnic origin, political opinion, religious or other belief, trade union membership, health, sex life or sexual orientation, or data on criminal or misdemeanor proceedings). The maximum rises again, to between six months and five years, where the offense is committed by an official person in the performance of their duty or a responsible person exercising public authority. This offense is separate from AZOP's Article 83 administrative fining power and from an individual's Article 82 civil claim.
Penalty structure
Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for infringements of the provisions listed in Article 83(5)(a) to (e), including non-compliance with a supervisory-authority order under Article 58. A lower Article 83(4) tier also exists, up to EUR 10,000,000 or 2 percent of turnover, for the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43. Croatia's implementation act (Narodne novine 42/18) adds a national administrative fine of up to HRK 50,000 in Article 51 for a controller or processor that fails to mark video-monitored premises, to keep the access log for video recordings, or to use recordings only for their purpose, and Article 47 bars administrative fines against public authorities. Its misdemeanor provision (Article 50) penalizes only an AZOP director, deputy director, or official who discloses confidential information learned in the course of duty.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Agencija za zastitu osobnih podataka (AZOP), Croatia's supervisory authority under GDPR Article 51, designated by the Act on the Implementation of the General Data Protection Regulation (Narodne novine 42/18).
Enforcement record
AZOP's published register of administrative fines records 97 fines totalling approximately EUR 10.5 million since the GDPR became applicable, and the highest single fine to date is EUR 5.47 million, against a debt-collection agency for serious infringements. The register gives these as cumulative figures only. It points to a separate year-by-year list of fines ('Na poveznici dostupne su upravne novčane kazne po godinama') but states no per-year count, median or 90th-percentile fine. The figures describe enforcement of the GDPR in Croatia as a whole, not this instrument's provisions alone.
- As of
- Currency
- EUR
- Source link
- https://azop.hr/upravne-novcane-kazne
- Total fines
- 10,500,000
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which Croatian rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 51 fines a controller or processor that does not set up the automated log of access to video surveillance recordings required by Article 28(4). This row cites Article 51 for the fine, so it carries the log duty only through that cross-reference; the log's contents are listed in Article 28(4), and GDPR Articles 82 and 83 set no record duty of their own. The row cites no provision that lets anyone demand the log.
- Kind
- Implicit
- As of
- Provision
- Act on the Implementation of the General Data Protection Regulation, Article 51, applying Article 28(4)
- Trigger
- personal_data_processing
What this law does
Agencija za zastitu osobnih podataka (AZOP) is Croatia's supervisory authority, entitled to impose administrative fines in line with General Data Protection Regulation (GDPR) Article 83 (Article 44(1) of the Act). A fine imposed on a body with public powers or a public service must not jeopardize the performance of that power or service (Article 44(2)). Article 47 of the Act bars administrative fines against public authorities.
Article 51 of the Act sets administrative fines of up to HRK 50,000 for a controller or processor that breaches the Act's video-surveillance duties. GDPR Article 82 arms an individual with a direct private right of action. Article 41 of the Act lets a data subject authorize a qualifying non-profit body to lodge a complaint and claim compensation under Article 82 on the subject's behalf.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .