AZOP (Croatia) - Croatian Gambling Operator
Croatian DPA fines gambling operator €2.59M for unlawful biometric data processing.
Run AZOP?
Get an email when a reviewed story names AZOP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Croatia's Data Protection Agency (AZOP) has fined a gambling operator €2.59 million for unlawfully processing customer fingerprint data. The operator collected biometric data for identification purposes without valid consent, bundled multiple processing purposes into a single consent statement, and provided incomplete and inconsistent information to data subjects.
The lesson from this incident
Full lessonA Croatian gambling operator was fined €2.59 million after collecting customer fingerprint data without valid legal basis, violating GDPR principles around lawful processing and informed consent. The operator compounded the violation by bundling multiple data processing purposes into a single consent statement, making it impossible for users to grant or withhold consent granularly. Incomplete and inconsistent disclosures to data subjects further undermined transparency obligations. This case underscores that biometric data — classified as a special category under GDPR Article 9 — demands the highest standard of care, explicit consent, and clear communication. Failure to meet these standards exposes organizations to significant financial and reputational damage.