AZOP (Croatia) - Croatian Gambling Operator
Croatian gambling operator fined €2.59M for GDPR violations regarding biometric data processing.
Run AZOP?
Get an email when a reviewed story names AZOP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Croatia's Data Protection Agency (AZOP) has fined a gambling operator €2.59 million for multiple GDPR violations. The violations include processing biometric data (fingerprints and photographs) without valid consent, bundling diverse processing purposes into single consent statements, and providing inconsistent and incomplete information about data processing. The operator also failed to clearly link legal bases to specific processing activities.
The lesson from this incident
Full lessonA Croatian gambling operator was fined €2.59 million after AZOP found it had processed biometric data — including fingerprints and photographs — without obtaining valid, specific consent from individuals. The operator compounded the violation by bundling multiple, unrelated processing purposes into single blanket consent statements, which is explicitly prohibited under GDPR's requirement for granular, informed consent. Incomplete and inconsistent privacy notices further obscured individuals' rights, and the failure to clearly link legal bases to specific processing activities demonstrated a systemic lack of data governance maturity. This case highlights that special-category data such as biometrics demands the highest standard of lawful processing, and that vague or omnibus consent mechanisms will not satisfy regulators.