AZOP (Croatia) - Croatian Gambling Operator

A Croatian gambling operator was fined €2.59 million after collecting biometric data — including fingerprints and photographs — without valid, granular consent, and gathering more data than operationally necessary. The operator compounded violations by bundling multiple processing purposes into single consent statements, obscuring what data subjects were actually agreeing to. Collecting four fingerprints while claiming only two were taken further demonstrated a lack of internal data governance controls. This case highlights that biometric data, as a special category under GDPR Article 9, demands heightened scrutiny, explicit consent, and strict data minimization practices. Failing to implement these safeguards exposes organizations to significant regulatory penalties and reputational damage.