[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f50D9YT-FyjBfS_XfjHFZZIRadIoLNgIHaDjnFp9LsAo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"5ee33506-cd4c-476a-8858-b2067c8318fc","croatian-gambling-operator-fined-259m-for-biometric-data-gdpr-violations","044ad697-72ef-4c9b-af71-7586b8472e92","Croatian Gambling Operator Fined €2.59M for Biometric Data GDPR Violations","A Croatian gambling operator was fined €2.59 million after collecting biometric data — including fingerprints and photographs — without valid, granular consent, and gathering more data than operationally necessary. The operator compounded violations by bundling multiple processing purposes into single consent statements, obscuring what data subjects were actually agreeing to. Collecting four fingerprints while claiming only two were taken further demonstrated a lack of internal data governance controls. This case highlights that biometric data, as a special category under GDPR Article 9, demands heightened scrutiny, explicit consent, and strict data minimization practices. Failing to implement these safeguards exposes organizations to significant regulatory penalties and reputational damage.","**Immediate actions:**\n- Audit all existing consent mechanisms to ensure each processing purpose has a separate, explicit, and freely given consent statement.\n- Conduct a data inventory review to verify that only the minimum necessary data is being collected and retained, especially for biometric categories.\n\n**Long-term improvements:**\n- Implement a formal Data Protection Impact Assessment (DPIA) process for any processing involving biometric or special-category data before deployment.\n- Establish a data minimization policy with technical controls that enforce collection limits defined in privacy notices.\n- Appoint or empower a qualified Data Protection Officer (DPO) to continuously review processing activities against documented legal bases.\n\n**Detection & Monitoring:**\n- Schedule periodic internal audits comparing actual data collection practices against documented privacy notices and consent records.\n- Implement automated alerts for data collection volumes that exceed defined thresholds for sensitive or biometric data fields.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(b) – Purpose Limitation","GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 7 – Conditions for Consent","GDPR Article 9 – Processing of Special Categories of Data","GDPR Article 13 – Transparency and Information Obligations","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.DS-P1 – Data Processing Ecosystems","NIST SP 800-53 IP-1 – Consent","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management",{},"published","2026-10-11T22:20:17.259917+00:00","2026-10-11T22:20:17.238+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AZOP_(Croatia)_-_Croatian_Gambling_Operator&diff=53364&oldid=53361","azop-croatia-croatian-gambling-operator-ee884a","AZOP (Croatia) - Croatian Gambling Operator",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"d051bf22-f433-44ff-8c17-3f095490500d","2026-10-12","morning","ThreatNoir Morning Brief — October 12","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-12\u002Fthreatnoir-morning-brief-2026-10-12.mp3",[51,55],{"slug":52,"name":53,"problem":54},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":56,"name":57,"problem":58},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]