[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFMD9JiWqZQCbh1bRpILUMp42MaROd5fJsfbHqcb8gAc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":44,"controls":45},"2e8b47db-112f-4626-9ff5-3f989804898d","croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","7e769510-923c-4984-a3bd-2cb5fa28019d","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","A Croatian gambling operator was fined €2.59 million after collecting customer fingerprint data without valid legal basis, violating GDPR principles around lawful processing and informed consent. The operator compounded the violation by bundling multiple data processing purposes into a single consent statement, making it impossible for users to grant or withhold consent granularly. Incomplete and inconsistent disclosures to data subjects further undermined transparency obligations. This case underscores that biometric data — classified as a special category under GDPR Article 9 — demands the highest standard of care, explicit consent, and clear communication. Failure to meet these standards exposes organizations to significant financial and reputational damage.","**Immediate actions:**\n- Audit all biometric and special-category data processing activities to verify a valid legal basis exists for each purpose.\n- Disaggregate bundled consent statements so data subjects can independently accept or reject each distinct processing purpose.\n- Update privacy notices to ensure they are complete, consistent, and written in plain language accessible to all data subjects.\n\n**Long-term improvements:**\n- Conduct a Data Protection Impact Assessment (DPIA) before deploying any biometric identification system, as required by GDPR Article 35.\n- Establish a formal data governance policy that classifies biometric data as high-risk and mandates DPO sign-off before collection begins.\n- Implement a consent management platform that records consent timestamps, versions, and scope for every data subject.\n\n**Compliance & monitoring measures:**\n- Schedule regular internal compliance audits against GDPR Articles 6, 7, and 9 to detect unlawful processing before regulators do.\n- Train customer-facing and product teams on the distinction between special-category data and standard personal data, including handling requirements.\n- Assign clear ownership to a Data Protection Officer (DPO) for ongoing oversight of biometric data processing activities.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5 (Principles of lawful processing)","GDPR Article 6 (Lawfulness of processing)","GDPR Article 7 (Conditions for consent)","GDPR Article 9 (Processing of special categories of personal data)","GDPR Article 13 (Transparency obligations)","GDPR Article 35 (Data Protection Impact Assessment)","NIST Privacy Framework PR.CP-1 (Consent management)","NIST SP 800-122 (Guide to Protecting PII)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 (Privacy Information Management)","ITIL Service Design – Information Security Policy",{},"published","2026-10-13T16:21:00.144224+00:00","2026-10-13T16:21:00.119+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AZOP_(Croatia)_-_Croatian_Gambling_Operator&diff=53393&oldid=53386","azop-croatia-croatian-gambling-operator-79b387","AZOP (Croatia) - Croatian Gambling Operator",[32,38],{"id":33,"name":34,"slug":35,"description":36,"color":37},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]