AZOP (Croatia) - Croatian Gambling Operator
Croatian DPA fines gambling operator €2.59M for GDPR violations.
Run AZOP?
Get an email when a reviewed story names AZOP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Croatia's Personal Data Protection Agency (AZOP) has fined a gambling operator €2.59 million for multiple GDPR violations. The operator improperly processed biometric data, including fingerprint scans from four fingers instead of the necessary two, and bundled multiple processing purposes into single consent statements. Additionally, the provided information on data processing was inconsistent and incomplete, failing to meet transparency requirements.
The lesson from this incident
Full lessonThe gambling operator violated multiple GDPR principles by collecting excessive biometric data (four fingerprints instead of the legally necessary two), bundling distinct processing purposes into single consent statements, and providing inconsistent and incomplete information to data subjects. These failures breach core GDPR principles of data minimisation (Article 5(1)(c)), purpose limitation (Article 5(1)(b)), and transparency (Article 13/14). The case demonstrates that organisations handling sensitive biometric data face heightened scrutiny and must ensure consent mechanisms are granular, lawful, and clearly documented. Without robust internal data governance processes, organisations risk significant financial penalties and reputational damage.