[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNCFgoJefl6YqVs4gvghPu9oODx4LSsexAhTmlW7U-4I":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"0a72d532-52e5-4d60-b2e1-5ef80728feca","AZOP (Croatia) - Croatian Gambling Operator","azop-croatia-croatian-gambling-operator-8841cd","Created page with \"{{DPAdecisionBOX |Jurisdiction=Croatia |DPA-BG-Color= |DPAlogo=LogoHR.png |DPA_Abbrevation=AZOP |DPA_With_Country=AZOP (Croatia) |Case_Number_Name=Croatian Gambling Operator |ECLI= |Original_Source_Name_1=AZOP |Original_Source_Link_1=https:\u002F\u002Fazop.hr\u002Fupravna-novcana-kazna-priredivacu-igara-na-srecu-u-iznosu-od-259-milijuna-eura\u002F |Original_Source_Language_1=Croatian |Original_Source_Language__Code_1=HR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Sourc...\" New page {{DPAdecisionBOX |Jurisdiction=Croatia |DPA-BG-Color= |DPAlogo=LogoHR.png |DPA_Abbrevation=AZOP |DPA_With_Country=AZOP (Croatia) |Case_Number_Name=Croatian Gambling Operator |ECLI= |Original_Source_Name_1=AZOP |Original_Source_Link_1=https:\u002F\u002Fazop.hr\u002Fupravna-novcana-kazna-priredivacu-igara-na-srecu-u-iznosu-od-259-milijuna-eura\u002F |Original_Source_Language_1=Croatian |Original_Source_Language__Code_1=HR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Investigation |Outcome=Violation Found |Date_Started= |Date_Decided= |Date_Published=02.10.2026 |Year=2026 |Fine=2590000.0 |Currency=EUR |GDPR_Article_1=Article 4(11) GDPR |GDPR_Article_Link_1=Article 4 GDPR#11 |GDPR_Article_2=Article 5(1)(a) GDPR |GDPR_Article_Link_2=Article 5 GDPR#1a |GDPR_Article_3=Article 5(1)(c) GDPR |GDPR_Article_Link_3=Article 5 GDPR#1c |GDPR_Article_4=Article 6(1)(a) GDPR |GDPR_Article_Link_4=Article 6 GDPR#1a |GDPR_Article_5=Article 7 GDPR |GDPR_Article_Link_5=Article 7 GDPR |GDPR_Article_6=Article 9(1) GDPR |GDPR_Article_Link_6=Article 9 GDPR#1 |GDPR_Article_7=Article 9(2)(a) GDPR |GDPR_Article_Link_7=Article 9 GDPR#2a |GDPR_Article_8=Article 12(1) GDPR |GDPR_Article_Link_8=Article 12 GDPR#1 |GDPR_Article_9=Article 13 GDPR |GDPR_Article_Link_9=Article 13 GDPR |GDPR_Article_10= |GDPR_Article_Link_10= |GDPR_Article_11= |GDPR_Article_Link_11= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1=Article 22(2) ZPOUZP |National_Law_Link_1=https:\u002F\u002Fnarodne-novine.nn.hr\u002Fclanci\u002Fsluzbeni\u002F2018_05_42_805.html |National_Law_Name_2= |National_Law_Link_2= |National_Law_Name_3= |National_Law_Link_3= |Party_Name_1= |Party_Link_1= |Party_Name_2= |Party_Link_2= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status=Unknown |Appeal_To_Link= |Initial_Contributor= | }} The DPA fined a gambling operator €2.59 m for processing biometric data without valid consent and beyond the necessary scope, bundling multiple purposes into single consent, and providing incomplete and inconsistent processing information. == English Summary == === Facts === The DPA initiated an ex officio investigation against a gambling operator (controller) regarding the identification and registration of players (data subjects) visiting its casino. The controller verified data subjects' identities at its casino using physical identity cards. To expedite identification during subsequent visits, it also offered data subjects the option to use an RFID chip or fingerprint scanning . On the basis of the data subjects' consent, the controller collected fingerprint scans from 34,933 data subjects. Although the controller claimed to collect two fingerprints, the investigation established that it actually scanned four fingers (two per hand) for biometric identification of data subjects. The controller argued that collecting additional fingerprints provided backups if damaged skin caused scanning and identification errors. The investigation also found that the data subjects were presented with an interactive consent screen consisting of four separate consent statements during the registration process at the casino . The first consent statement required data subjects to consent to the collection of their fingerprints while combining multiple distinct processing purposes such as contract execution, identity verification, statistical analysis, profiling, service personalisation, protection of rights and property, and prevention of underage gambling, into a single consent statement. The second consent statement covered the collection of data subjects' photographs and similarly bundled multiple purposes including identity verification, protection of rights and property, and prevention of underage gambling. Additionally, the DPA also found that the controller provided data subjects with several documents on the processing of personal data upon registration. However, these documents provided inconsistent and incomplete information regarding processing purposes and legal bases, with the purposes of certain processing activities not being specified and the legal bases not clearly linked to the specific processing activities. === Holding === The DPA held that the controller committed multiple violations of the GDPR and imposed an administrative fine of €2.59 m. First, the DPA held that the controller processed data subjects' biometric data without valid consent and beyond what was necessary, violating [[[[Article 6 GDPR|Article 6 GDPR]]#1|Article 6(1)]] and [[[[Article 9 GDPR|Article 9 GDPR]]#1|Article 9(1)]] in connection with [[[[Article 9 GDPR|Article 9 GDPR]]#2a|Article 9(2)(a)]], read alongside [[[[Article 5 GDPR|Article 5 GDPR]]#1a|Article 5(1)(a)]] and [[[[Article 5 GDPR|Article 5 GDPR]]#1c|Article 5(1)(c)]]. The DPA found that collecting fingerprints from four fingers instead of two exceeded the scope necessary for data subject identification. According to the DPA, the controller's general justification of needing backup prints in case of skin damage did not prove the necessity for their collection. Instead, the controller should have demonstrated why collecting four fingerprints is necessary for the specific purpose and whether fewer prints with supplementary verification methods would have been just as effective. Even though the Croatian GDPR Implementation Act (Zakon o provedbi Opće uredbe o zaštiti podataka) allowed the processing of biometric data for the secure identification of data subjects based on consent, the DPA noted that consent itself cannot legitimise collecting more personal data than is strictly necessary for a specific purpose. Second, the DPA found that the controller failed to meet the consent requirements from [[[[Article 7 GDPR|Article 7 GDPR]]]] in connection with [[[[Article 4 GDPR|Article 4 GDPR]]#11|Article 4(11)]] in two of its four consent statements. The DPA held that the controller bundled different processing purposes without providing the data subjects with an option to give consent separately for each purpose and did not present the consent statements clearly and intelligibly enough for processing of data subjects' fingerprints and photographs. Finally, the DPA considered that the controller provided data subjects with incomplete, inaccurate, and contradictory information across its documents in terms of purposes and legal bases of specific processing operations, thereby violating violated [[[[Article 12 GDPR|Article 12 GDPR]]#1|Article 12(1)]] and [[[[Article 13 GDPR|Article 13 GDPR]]]] in connection with the principle of transparency from [[[[Article 5 GDPR|Article 5 GDPR]]#1|Article 5(1)(a)]]. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details. Administrative monetary penalty of 2.59 million euros imposed on a gambling operator The Personal Data Protection Agency, on its own initiative, conducted an oversight proceeding against the data controller, a company that operates as a gambling provider, and for the violations listed below, imposed an administrative fine totaling €2,590,000.00. Processing of biometric data without valid consent and to an unnecessary extent The data controller, in addition to identifying players by inspecting their ID cards, introduced the option of identification via an RFID chip or fingerprints if a player wishes to complete the identification process more quickly on subsequent visits. Although the controller claimed to collect prints from two fingers, the monitoring found that prints from four fingers (two from each hand) were collected and used for the player's biometric identification. By collecting prints from four fingers, the data controller collected a larger scope of personal data than was necessary to achieve the specific purpose (player identification). The controller justified the need for additional fingerprints by stating that skin damage on the fingers could occur, which could lead to an incorrect or failed scan and identification. However, a general reference to the availability of \"backup\" fingerprints does not, in itself, prove the necessity of collecting them, rather, the controller must be able to demonstrate why it is necessary to collect the specified scope of data (four fingerprints) for a specific purpose and whether the purpose can be achieved just as effectively by processing a smaller number of fingerprints, with appropriate additional identity verification methods. Under the General Data Protection Regulation Implementation Act, the processing of biometric data for the secure identification of service users is lawful with the explicit consent of the data subject, which is given in accordance with the provisions of the Regulation. If the controller collects a larger scope of personal data than is necessary to achieve a specific purpose, such processing cannot become lawful simply because the data subject has given consent. This is especially true for biometric data, given its nature, sensitivity, and the increased risk to the rights and freedoms of the data subject. Specifically, processing that is formally based on the data subject's consent must be lawful, fair, transparent, adequate, relevant, and limited to what is necessary in relation to the purpose of the processing. In the specific case, a consent statement for the processing of biometric data was recorded for 34,933 players. Accordingly, it was determined that the data subjects' biometric data was processed without valid consent and to an extent not necessary for the stated purpose, thereby violating Article 6(1). and Article 9(1) in relation to paragraph 2(a), in relation to Article 5(1)(a) and (c). Failure to meet the consent requirements under the General Data Protection Regulation Furthermore, during player registration at the casino, the document displays interactive fields on the screen for providing four consents. In this regard, the Agency found that the first two texts of the document do not meet the requirements for consent under the General Data Protection Regulation, which must be voluntary, specific, informed, and unambiguous. The controller combined multiple different purposes for data processing into a single consent and did not give the player a real opportunity to separately decide what they were agreeing to. In the first consent statement[1], which relates to the collection and processing of scanned fingerprints, different purposes of processing were combined. The player is presented with information that creates the impression that all processing in the registration process is based on consent, without a clear distinction between the legally required processing of identification data and the optional processing of biometric data. Such a formulation is not consistent with the requirement that consent be specific and voluntary, as the player could not separately decide which purposes they agreed to and which they did not. Furthermore, in the second consent statement[2], which relates to the collection and processing of the respondent's photograph, various purposes are also listed. As a result, the respondent cannot clearly determine whether the photograph is used only for identity verification or for other purposes as well, nor can they make a separate decision about each. Ultimately, in the consent statements, the controller combines different purposes of processing without the possibility of separate consent for each individual purpose and does not present the consent requests clearly and understandably enough, thereby violating Article 7 in conjunction with Article 4(11) of the General Data Protection Regulation. Incomplete and mutually inconsistent information on the processing of personal data Upon registering at the casino, the respondent was presented with multiple documents regarding the processing of personal data, which contained inconsistent and incomplete information about the purposes and legal bases for processing. The purposes of certain processing were not specified, and the legal bases were not clearly linked to specific processing activities. For example, in the General Rules, the controller also links fingerprinting to purposes beyond identification upon entering the casino, stating that it is used for controlling and monitoring entry to its premises, protecting minors, participating in games of chance, the bonus reward system program, and other purposes. By doing so, the controller failed to comply with the requirements for transparent personal data processing, as the information it provided to data subjects was incomplete, inaccurate, and mutually contradictory regarding the purposes and legal bases of the individual processing operations. As a result, the data subjects could not find out in a clear and understandable way for what purposes and on what legal basis the controller processes their personal data. By doing so, the data controller violated Article 12(1) and Article 13 of the General Data Protection Regulation, in relation to the principle of transparency from Article 5(1)(a) of the same Regulation. [1] \"I consent to the collection and processing of biometric data, namely a fingerprint scan, which data is collected for the purpose of providing services\u002Fperforming a contract, identifying the parties, statistical purposes, profiling, improving and personalizing the service, protecting rights and property, enforcing the ban on minors participating in gambling\". [2] \"I consent to the collection and processing of my personal data – biometric data, namely a photograph, which is collected for the purpose of identifying the parties, protecting rights and property, and enforcing the ban on underage gambling.\"","Croatia's Personal Data Protection Agency (AZOP) has fined a gambling operator €2.59 million for multiple GDPR violations. The operator improperly processed biometric data, including fingerprint scans from four fingers instead of the necessary two, and bundled multiple processing purposes into single consent statements. Additionally, the provided information on data processing was inconsistent and incomplete, failing to meet transparency requirements.","Croatian DPA fines gambling operator €2.59M for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AZOP_(Croatia)_-_Croatian_Gambling_Operator&diff=53361&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F8b\u002FLogoHR.png","2026-10-11T20:23:02+00:00","2026-10-11T22:00:06.843579+00:00",7,[17],{"name":18,"type":19},"AZOP","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":64},"croatian-gambling-operator-fined-259m-for-gdpr-biometric-and-consent-violations","Croatian Gambling Operator Fined €2.59M for GDPR Biometric and Consent Violations","The gambling operator violated multiple GDPR principles by collecting excessive biometric data (four fingerprints instead of the legally necessary two), bundling distinct processing purposes into single consent statements, and providing inconsistent and incomplete information to data subjects. These failures breach core GDPR principles of data minimisation (Article 5(1)(c)), purpose limitation (Article 5(1)(b)), and transparency (Article 13\u002F14). The case demonstrates that organisations handling sensitive biometric data face heightened scrutiny and must ensure consent mechanisms are granular, lawful, and clearly documented. Without robust internal data governance processes, organisations risk significant financial penalties and reputational damage.",[53,54,55,56,57,58,59,60,61,62,63],"GDPR Article 5(1)(b) – Purpose Limitation","GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 7 – Conditions for Consent","GDPR Article 9 – Processing of Special Categories of Data (Biometric)","GDPR Article 13\u002F14 – Transparency and Information Obligations","GDPR Article 30 – Records of Processing Activities","GDPR Article 37-39 – Data Protection Officer","NIST Privacy Framework PR.DS-P1 – Data Processing Minimisation","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework",{}]