[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fM8PMcMHJYZcpyqP2kmlKukTpPiX8MwKlPRkaRkzZeIM":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"7e769510-923c-4984-a3bd-2cb5fa28019d","AZOP (Croatia) - Croatian Gambling Operator","azop-croatia-croatian-gambling-operator-79b387","← Older revision Revision as of 14:29, 13 October 2026 Line 116: Line 116: }} }} The DPA fined a gambling operator €2.59 m for processing biometric data without valid consent and beyond the necessary scope, bundling multiple purposes into single consent, and providing incomplete and inconsistent processing information. The DPA fined a gambling operator €2.59 m for unlawfully processing its customers’ fingerprints for identification purposes without valid consent and for bundling multiple purposes into a single consent as well as for providing incomplete and inconsistent information. == English Summary == == English Summary ==","Croatia's Data Protection Agency (AZOP) has fined a gambling operator €2.59 million for unlawfully processing customer fingerprint data. The operator collected biometric data for identification purposes without valid consent, bundled multiple processing purposes into a single consent statement, and provided incomplete and inconsistent information to data subjects.","Croatian DPA fines gambling operator €2.59M for unlawful biometric data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AZOP_(Croatia)_-_Croatian_Gambling_Operator&diff=53393&oldid=53386","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F8b\u002FLogoHR.png","2026-10-13T14:29:05+00:00","2026-10-13T16:00:03.764403+00:00",8,[17,20],{"name":18,"type":19},"AZOP","vendor",{"name":21,"type":22},"fingerprint scanning","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":23,"icon":25,"name":26,"slug":27},null,"Privacy Fines","privacy-fines",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":62},"croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","A Croatian gambling operator was fined €2.59 million after collecting customer fingerprint data without valid legal basis, violating GDPR principles around lawful processing and informed consent. The operator compounded the violation by bundling multiple data processing purposes into a single consent statement, making it impossible for users to grant or withhold consent granularly. Incomplete and inconsistent disclosures to data subjects further undermined transparency obligations. This case underscores that biometric data — classified as a special category under GDPR Article 9 — demands the highest standard of care, explicit consent, and clear communication. Failure to meet these standards exposes organizations to significant financial and reputational damage.",[51,52,53,54,55,56,57,58,59,60,61],"GDPR Article 5 (Principles of lawful processing)","GDPR Article 6 (Lawfulness of processing)","GDPR Article 7 (Conditions for consent)","GDPR Article 9 (Processing of special categories of personal data)","GDPR Article 13 (Transparency obligations)","GDPR Article 35 (Data Protection Impact Assessment)","NIST Privacy Framework PR.CP-1 (Consent management)","NIST SP 800-122 (Guide to Protecting PII)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 (Privacy Information Management)","ITIL Service Design – Information Security Policy",{}]