[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGOr0TdQeY0Fz_GTykT0MbiOX-lNAX2DiD1cZ0ZrDwWU":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":94},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"044ad697-72ef-4c9b-af71-7586b8472e92","AZOP (Croatia) - Croatian Gambling Operator","azop-croatia-croatian-gambling-operator-ee884a","Minor spelling edit ← Older revision Revision as of 21:06, 11 October 2026 (2 intermediate revisions by the same user not shown) Line 122: Line 122: === Facts === === Facts === The DPA initiated an ex officio investigation against a gambling operator (controller) regarding the identification and registration of players (data subjects) visiting its casino. The DPA initiated an ex officio investigation against a gambling operator (controller) regarding the identification and registration of players (data subjects) visiting its casino. The controller verified data subjects' identities at its casino using physical identity cards. To expedite identification during subsequent visits, it also offered data subjects the option to use an RFID chip or fingerprint scanning . On the basis of the data subjects' consent, the controller collected fingerprint scans from 34,933 data subjects. Although the controller claimed to collect two fingerprints, the investigation established that it actually scanned four fingers (two per hand) for biometric identification of data subjects. The controller argued that collecting additional fingerprints provided backups if damaged skin caused scanning and identification errors. The investigation also found that the data subjects were presented with an interactive consent screen consisting of four separate consent statements during the registration process at the casino . The first consent statement required data subjects to consent to the collection of their fingerprints while combining multiple distinct processing purposes such as contract execution, identity verification, statistical analysis, profiling, service personalisation, protection of rights and property, and prevention of underage gambling, into a single consent statement. The second consent statement covered the collection of data subjects' photographs and similarly bundled multiple purposes including identity verification, protection of rights and property, and prevention of underage gambling. The controller verified data subjects' identities at its casino using physical identity cards. To expedite identification during subsequent visits, it also offered data subjects the option to use an RFID chip or fingerprint scanning. On the basis of the data subjects' consent, the controller collected fingerprint scans from 34,933 data subjects. Although the controller claimed to collect two fingerprints, the investigation established that it actually scanned four fingers (two per hand) for biometric identification of data subjects. The controller argued that collecting additional fingerprints provided backups if damaged skin caused scanning and identification errors. The investigation also found that the data subjects were presented with an interactive consent screen consisting of four separate consent statements during the registration process at the casino. The first consent statement required data subjects to consent to the collection of their fingerprints while combining multiple distinct processing purposes such as contract execution, identity verification, statistical analysis, profiling, service personalisation, protection of rights and property, and prevention of underage gambling, into a single consent statement. The second consent statement covered the collection of data subjects' photographs and similarly bundled multiple purposes including identity verification, protection of rights and property, and prevention of underage gambling. Additionally, the DPA also found that the controller provided data subjects with several documents on the processing of personal data upon registration. However, these documents provided inconsistent and incomplete information regarding processing purposes and legal bases, with the purposes of certain processing activities not being specified and the legal bases not clearly linked to the specific processing activities. Additionally, the DPA also found that the controller provided data subjects with several documents on the processing of personal data upon registration. However, these documents provided inconsistent and incomplete information regarding processing purposes and legal bases, with the purposes of certain processing activities not being specified and the legal bases not clearly linked to the specific processing activities. === Holding === === Holding === The DPA held that the controller committed multiple violations of the GDPR and imposed an administrative fine of €2.59 m. The DPA held that the controller committed multiple violations of the GDPR and imposed an administrative fine of €2.59 m. First, the DPA held that the controller processed data subjects' biometric data without valid consent and beyond what was necessary, violating [[[[Article 6 GDPR|Article 6 GDPR]]#1|Article 6(1)]] and [[[[Article 9 GDPR|Article 9 GDPR]]#1|Article 9(1)]] in connection with [[[[Article 9 GDPR|Article 9 GDPR]]#2a|Article 9(2)(a)]], read alongside [[[[Article 5 GDPR|Article 5 GDPR]]#1a|Article 5(1)(a)]] and [[[[Article 5 GDPR|Article 5 GDPR]]#1c|Article 5(1)(c)]]. The DPA found that collecting fingerprints from four fingers instead of two exceeded the scope necessary for data subject identification. According to the DPA, the controller's general justification of needing backup prints in case of skin damage did not prove the necessity for their collection. Instead, the controller should have demonstrated why collecting four fingerprints is necessary for the specific purpose and whether fewer prints with supplementary verification methods would have been just as effective. Even though the Croatian GDPR Implementation Act (Zakon o provedbi Opće uredbe o zaštiti podataka) allowed the processing of biometric data for the secure identification of data subjects based on consent, the DPA noted that consent itself cannot legitimise collecting more personal data than is strictly necessary for a specific purpose. Second, the DPA found that the controller failed to meet the consent requirements from [[[[Article 7 GDPR|Article 7 GDPR]]]] in connection with [[[[Article 4 GDPR|Article 4 GDPR]]#11|Article 4(11)]] in two of its four consent statements. The DPA held that the controller bundled different processing purposes without providing the data subjects with an option to give consent separately for each purpose and did not present the consent statements clearly and intelligibly enough for processing of data subjects' fingerprints and photographs. First, the DPA held that the controller processed data subjects' biometric data without valid consent and beyond what was necessary, violating [[Article 6 GDPR#1|Article 6(1)]] and [[Article 9 GDPR#1|Article 9(1)]] in connection with [[Article 9 GDPR#2a|Article 9(2)(a)]], read alongside [[Article 5 GDPR#1a|Article 5(1)(a)]] and [[Article 5 GDPR#1c|Article 5(1)(c)]]. The DPA found that collecting fingerprints from four fingers instead of two exceeded the scope necessary for data subject identification. According to the DPA, the controller's general justification of needing backup prints in case of skin damage did not prove the necessity for their collection. Instead, the controller should have demonstrated why collecting four fingerprints is necessary for the specific purpose and whether fewer prints with supplementary verification methods would have been just as effective. Even though the Croatian GDPR Implementation Act (Zakon o provedbi Opće uredbe o zaštiti podataka) allowed the processing of biometric data for the secure identification of data subjects based on consent, the DPA noted that consent itself cannot legitimise collecting more personal data than is strictly necessary for a specific purpose. Finally, the DPA considered that the controller provided data subjects with incomplete, inaccurate, and contradictory information across its documents in terms of purposes and legal bases of specific processing operations, thereby violating violated [[[[Article 12 GDPR|Article 12 GDPR]]#1|Article 12(1)]] and [[[[Article 13 GDPR|Article 13 GDPR]]]] in connection with the principle of transparency from [[[[Article 5 GDPR|Article 5 GDPR]]#1|Article 5(1)(a)]]. Second, the DPA found that the controller failed to meet the consent requirements from [[Article 7 GDPR]] in connection with [[Article 4 GDPR#11|Article 4(11)]] in two of its four consent statements. The DPA held that the controller bundled different processing purposes for the processing of data subjects' fingerprints and photographs, without providing the data subjects with an option to give consent separately for each purpose. Furthermore, according to the DPA, the controller did not present the consent statements clearly and intelligibly enough. Finally, the DPA considered that the controller provided data subjects with incomplete, inaccurate, and contradictory information across its documents in terms of purposes and legal bases of specific processing operations, thereby violating [[Article 12 GDPR#1|Article 12(1)]] and [[Article 13 GDPR]] in connection with the principle of transparency from [[Article 5 GDPR#1|Article 5(1)(a)]]. == Comment == == Comment ==","Croatia's Data Protection Agency (DPA) has fined a gambling operator €2.59 million for multiple GDPR violations. The violations included processing biometric data (fingerprints and photographs) without valid consent, collecting more data than necessary, and failing to provide clear and complete information about data processing purposes and legal bases. The DPA found that the operator bundled multiple processing purposes into single consent statements and collected four fingerprints instead of the two claimed, deeming the additional collection unnecessary.","Croatian DPA fines gambling operator €2.59M for GDPR violations related to biometric data collection.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AZOP_(Croatia)_-_Croatian_Gambling_Operator&diff=53364&oldid=53361","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F8b\u002FLogoHR.png","2026-10-11T21:06:33+00:00","2026-10-11T22:00:06.843579+00:00",7,[17],{"name":18,"type":19},"AZOP","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":93},[47,76],{"slug":48,"name":49,"problem":50,"products":51},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":77,"name":78,"problem":79,"products":80},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[81,87],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":82,"product_name":83,"url":85,"description":86},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":88,"product_name":89,"url":91,"description":92},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":95,"title":96,"body":97,"framework_refs":98,"framework_notes":109},"croatian-gambling-operator-fined-259m-for-biometric-data-gdpr-violations","Croatian Gambling Operator Fined €2.59M for Biometric Data GDPR Violations","A Croatian gambling operator was fined €2.59 million after collecting biometric data — including fingerprints and photographs — without valid, granular consent, and gathering more data than operationally necessary. The operator compounded violations by bundling multiple processing purposes into single consent statements, obscuring what data subjects were actually agreeing to. Collecting four fingerprints while claiming only two were taken further demonstrated a lack of internal data governance controls. This case highlights that biometric data, as a special category under GDPR Article 9, demands heightened scrutiny, explicit consent, and strict data minimization practices. Failing to implement these safeguards exposes organizations to significant regulatory penalties and reputational damage.",[99,100,101,102,103,104,105,106,107,108],"GDPR Article 5(1)(b) – Purpose Limitation","GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 7 – Conditions for Consent","GDPR Article 9 – Processing of Special Categories of Data","GDPR Article 13 – Transparency and Information Obligations","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.DS-P1 – Data Processing Ecosystems","NIST SP 800-53 IP-1 – Consent","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management",{}]