[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1ZMI9i_7YaWL0YGKe8x48mu4pc1atmZOJ98AmU7CWgU":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"eb14684b-d0cb-4e50-9546-1253cee55f59","AZOP (Croatia) - Croatian Gambling Operator","azop-croatia-croatian-gambling-operator-275062","← Older revision Revision as of 13:40, 13 October 2026 (One intermediate revision by the same user not shown) Line 127: Line 127: The investigation also found that the data subjects were presented with an interactive consent screen consisting of four separate consent statements during the registration process at the casino. The first consent statement required data subjects to consent to the collection of their fingerprints while combining multiple distinct processing purposes such as contract execution, identity verification, statistical analysis, profiling, service personalisation, protection of rights and property, and prevention of underage gambling, into a single consent statement. The second consent statement covered the collection of data subjects' photographs and similarly bundled multiple purposes including identity verification, protection of rights and property, and prevention of underage gambling. The investigation also found that the data subjects were presented with an interactive consent screen consisting of four separate consent statements during the registration process at the casino. The first consent statement required data subjects to consent to the collection of their fingerprints while combining multiple distinct processing purposes such as contract execution, identity verification, statistical analysis, profiling, service personalisation, protection of rights and property, and prevention of underage gambling, into a single consent statement. The second consent statement covered the collection of data subjects' photographs and similarly bundled multiple purposes including identity verification, protection of rights and property, and prevention of underage gambling. Additionally, the DPA also found that the controller provided data subjects with several documents on the processing of personal data upon registration. However, these documents provided inconsistent and incomplete information regarding processing purposes and legal bases, with the purposes of certain processing activities not being specified and the legal bases not clearly linked to the specific processing activities. Additionally, the controller provided data subjects with several documents on the processing of personal data upon registration. However, these documents provided inconsistent and incomplete information regarding processing purposes and legal bases, with the purposes of certain processing activities not being specified and the legal bases not clearly linked to the specific processing activities.","Croatia's Data Protection Agency (AZOP) has fined a gambling operator €2.59 million for multiple GDPR violations. The violations include processing biometric data (fingerprints and photographs) without valid consent, bundling diverse processing purposes into single consent statements, and providing inconsistent and incomplete information about data processing. The operator also failed to clearly link legal bases to specific processing activities.","Croatian gambling operator fined €2.59M for GDPR violations regarding biometric data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AZOP_(Croatia)_-_Croatian_Gambling_Operator&diff=53386&oldid=53364","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F8b\u002FLogoHR.png","2026-10-13T13:40:05+00:00","2026-10-13T14:00:14.053161+00:00",8,[17,20],{"name":18,"type":19},"AZOP","vendor",{"name":21,"type":22},"gambling operator","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":67},"croatian-gambling-operator-fined-259m-for-gdpr-consent-and-biometric-data-failures","Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures","A Croatian gambling operator was fined €2.59 million after AZOP found it had processed biometric data — including fingerprints and photographs — without obtaining valid, specific consent from individuals. The operator compounded the violation by bundling multiple, unrelated processing purposes into single blanket consent statements, which is explicitly prohibited under GDPR's requirement for granular, informed consent. Incomplete and inconsistent privacy notices further obscured individuals' rights, and the failure to clearly link legal bases to specific processing activities demonstrated a systemic lack of data governance maturity. This case highlights that special-category data such as biometrics demands the highest standard of lawful processing, and that vague or omnibus consent mechanisms will not satisfy regulators.",[56,57,58,59,60,61,62,63,64,65,66],"GDPR Article 5 (Principles of data processing)","GDPR Article 6 (Lawfulness of processing)","GDPR Article 7 (Conditions for consent)","GDPR Article 9 (Processing of special categories of data)","GDPR Article 13 & 14 (Transparency and information obligations)","GDPR Article 35 (Data Protection Impact Assessment)","NIST Privacy Framework PR.CP-1 (Consent management)","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 PT-5 (Privacy Notice)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 (Privacy Information Management System)",{}]