US Split - Us I-2709/2025-11

Summary

The Administrative Court of Split, Croatia, has upheld a €5,000 fine imposed by the Data Protection Agency (AZOP) on petrol station operator INA. The fine was issued because INA made real-time CCTV feeds visible to customers, which the court deemed unauthorized access to personal data. INA's appeal was rejected as the court found the company failed to meet GDPR requirements for legitimate interest and security measures, stating that customer visibility of live feeds posed risks of unauthorized copying and sharing.

Full text

Help US Split - Us I-2709/2025-11: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 13:57, 6 October 2026 view source Lara.d (talk | contribs)1 edit Tag: Decisions [1.0] (No difference) Latest revision as of 13:57, 6 October 2026 US Split - Us I-2709/2025-11 Court: US Split (Croatia) Jurisdiction: Croatia Relevant Law: Article 4(1) GDPR Article 5(1) GDPR Article 6(1)(f) GDPR Article 32(1) GDPR Article 32(2) GDPR Article 46(2) GDPR Article 57(1)(h) GDPR Article 58(2)(d) GDPR Article 58(2)(i) GDPR Article 83 GDPR Article 83(4)(a) GDPR čl. 46. stavku 2. Zakona o provedbi Opće uredbe o zaštiti podatakačl. 8. čl. 47. st. 1. čl. 98. st. 5. čl. 128. st. 1. Zakon o općem upravnom postupkučlanku 47. stavku 3., članka 116. st. 1. , čl.147. st. 1. Zakon o upravnim sporovima Decided: 05.05.2026 Published: 05.07.2026 Parties: Agencija za zaštitu osobnih podataka (AZOP) INA - industrija nafte d.d. Zagreb National Case Number/Name: Us I-2709/2025-11 European Case Law Identifier: Appeal from: Appeal to: Unknown Original Language(s): Croatian Original Source: Tražilica odluka sudova RH (in Croatian) Initial Contributor: Lara Draskovic A court ruled that the use of security camera systems and real-time CCTV feeds by the petrol station operator, INA, should not be made available and visible to the customers. Court ruled this as unauthorised access to personal data and upheld the DPA’s €5,000 fine. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts INA, a petrol station chain in Croatia, appealed, AZOP's, the DPA's, €5000 fine. The fine was based on AZOP's decision that INA, as a controller, did not take all necessary measures to prevent unauthorised access and visibility of the real-time CCTV feeds to all customers. INA disputed this decision, claiming legitimate grounds for such data processing, stressing that projecting real-time CCTV feeds in petrol station shops to customers is an accepted and normal practice in the industry and by the consumers themselves. Holding The Court upheld the DPA's decision regardless, on two crucial grounds: the lack of compliance with the cumulative requirements to fulfil Art 6 GDPR and Art 32 (1 and 2) GDPR. Firstly, the Court sided with the DPA, stating INA, did not meet two of the three cumulative conditions, in depicting a legitimate interest for the purpose of ensuring a timely response by employees and deterring perpetrators of criminal and infringing acts. Therefore, the Court accepted the reasoning that, the requirement of necessity is not met, as the timely reaction by employees and a rapid response in the event of a harmful incident, can be achieved even without customers having real-time access to the video surveillance system. As Art 6(1)(f) prescribes that three conditions must be met cumulatively for the data controller to be able to demonstrate its legitimate interest for a lawful basis, the prescribed conditions are not cumulatively met. Secondly, the Court highlights that the screen's placement in the premises of the retail shop of the petrol station itself, with clear visibility for all, is contrary to Art 32(1) and (2) GDPR. The Court stresses INA failed to take necessary protection measures in accordance with existing and foreseeable risks of unauthorized disclosure of personal data. This becomes especially relevant, as the the controller allows customers, as unauthorised persons, access to the live feed in real time, exposing the personal data to risks such as copying, recording, or other unauthorised use of the video surveillance footage, or the sharing of such footage with third parties in any way. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details. Case No.: US I-2709/2025-11 REPUBLIC OF CROATIA ADMINISTRATIVE COURT IN SPLIT Put Supavla l IN THE NAME OF THE REPUBLIC OF CROATIA JUDGMENT The Administrative Court in Split, before Leandra Mojtić, judge of that court, as the single judge, and Milka Škaro Grozdanić, court clerk, in the administrative dispute of the plaintiff INA – Industrija nafte d.d., Zagreb, Avenija Većeslava Holjevca 10, OIB: 27759560625, represented by Tarja Krehić, attorney-at-law in Zagreb, against the defendant, the Personal Data Protection Agency (AZOP), Zagreb, Selska cesta 136, OIB: 28454963989, represented by Matija Kontak, Counsel in the Sector for EU, International Cooperation, and Legal Affairs, employed by the Agency for Personal Data Protection (AZOP), for violation of the right to personal data protection, following an oral and public hearing concluded on April 10, 2026, and published on May 5, 2026, HELD: I. The plaintiff's claim for the annulment of the decision of the Personal Data Protection Agency, Zagreb, CLASSE: UP/I-034-01/24-01/1, URBROJ: 567-04-01107-24-1 of April 12, 2024, as unfounded. II. The plaintiff's request for reimbursement of administrative litigation costs is denied as unfounded. Rationale 1. By the contested decision of the respondent, the Personal Data Protection Agency, Zagreb, CLASSE: UP/I-034-01/24-01/1, URBROJ: 567-04-01107-24-1 of April 12, 2024. in point 1 of the dispositive part, it is determined that the company INA - Industrija nafte d.d. Zagreb, as the data controller, within the retail location (gas station) INA Zadar – Jazine at [address], contrary to Article 32(1) and (2) of the General Data Protection Regulation, did not take appropriate technical measures to ensure that personal data would not be accessed without authorization. General Data Protection Regulation, failed to implement appropriate technical measures to ensure unauthorized access to personal data processed by the video surveillance system installed at the premises of the subject retail location. Paragraph 2 of the dispositive part provides that for the violation described in paragraph 1 of the dispositive part of this decision, in accordance with the provisions of Article 83. General Data Protection Regulation, imposes an administrative fine in the amount of 5,000.00 EUR on the company INA - Industrija nafte d.d. of Zagreb, Avenija Većeslava Holjevca 10 (in words: five thousand euros) Paragraph 3 of the dispositive section provides that INA - Industrija nafte d.d. Zagreb is obligated to pay the imposed administrative fine to the state budget within 15 days from the date of the finality of this decision to the designated account. Paragraph 4 of the dispositive section provides that if the company INA - Industrija nafte d.d. Zagreb does not pay the administrative fine within 15 days of the entry of this decision, the Personal Data Protection Agency will, in accordance with Article 46(2) the Personal Data Protection Agency shall, in accordance with Article 46(2) of the Law on the Implementation of the General Data Protection Regulation, notify the Regional Office of the Tax Administration of the Ministry of Finance in whose jurisdiction the company's headquarters is located, for the purpose of the forced collection of the administrative fine in accordance with regulations on the forced collection of taxes.Point 5 of the judgment ruled that INA - Industrija nafte d.d. of Zagreb is required to submit proof of payment to the Personal Data Protection Agency within 15 days of the payment.2. The plaintiff timely filed an extensive lawsuit with the Administrative Court in Zagreb against the contested decision, challenging its legality on the grounds of an erroneously established factual state, incorrect application of substantive law, and a violation of administrative procedure provisions. In the lawsuit, the plaintiff describes the chronology of the administrative case in question, essentially stating that the dispositive part of the contes

Entities