Croatia Data Protection & Privacy Regulation

Lawful Processing & Special Data

AZOP's 2 October 2026 decision against an unnamed gambling operator applies the consent-validity and special-category rules together in a single enforcement action. On consent, AZOP found that the operator presented four bundled consent fields covering distinct processing purposes, without a mechanism allowing a user to consent to one purpose while withholding consent to another. That structure fails the requirement that consent be freely given, specific, informed and unambiguous, since bundling removes the specificity a data subject needs to make a genuine choice about each distinct purpose.

On special-category data, the decision found that the operator collected four fingerprints per player, two from each hand, for identification purposes, despite having represented to users that only two fingerprints, one per hand, were being collected. AZOP found that the operator could not demonstrate that the larger scope of biometric collection was necessary for the stated identification purpose, and that reliance on a justification of needing a backup fingerprint, without more, did not meet that necessity standard. The finding affected 34,933 players, a scale that elevates this beyond an isolated procedural defect and into a population-wide data-minimisation failure. Press reporting identifies the operator as Admiral, though AZOP's own release does not name the entity, and this identification should be treated as unconfirmed by the regulator itself.

Together, the consent and biometric findings describe an operator whose data-collection architecture had grown beyond what it had disclosed to users and beyond what it could justify as necessary, two distinct GDPR Article 5 and Article 9 problems converging in a single enforcement outcome. The EUR 2,590,000 fine reflects the combined weight of both findings rather than either issue standing alone.

Outlook

The decision gives Croatian controllers operating consent flows with multiple bundled processing purposes, and those operating biometric identification systems generally, a concrete applied benchmark for both consent granularity and necessity testing. Where the fined operator's identity is confirmed, or where the decision is tested on appeal, the precedent value of this decision for other consent-bundling and biometric-collection practices in Croatia is likely to sharpen further.

Controller/Processor Duties

AZOP's finding against an unnamed gambling operator centres on two distinct controller-duty failures. First, the operator collected four fingerprints per casino player for identification purposes without demonstrating that collecting all four was necessary, which speaks directly to data minimisation obligations: a controller processing biometric data for identification purposes is expected to justify the scope of what it collects against what the stated purpose actually requires, and collecting a fuller biometric dataset than a stated identification purpose demands is the kind of gap AZOP's finding appears to target. Second, the operator's consent forms impermissibly bundled multiple processing purposes together, which goes to the separate obligation that consent, where relied upon as a lawful basis, must be specific and granular rather than an omnibus authorisation covering several distinct purposes at once.

The scale of the processing under scrutiny is notable: consent to biometric data processing had been recorded for 34,933 players, indicating this was not a narrow or isolated processing activity but one embedded in the operator's standard customer-identification workflow across a substantial player base. That scale is part of what gives the finding its materiality, since a security-measures or consent-design gap of this kind, replicated across tens of thousands of data subjects, represents a systemic control weakness rather than an isolated lapse.

It should be stated plainly that the precise GDPR article or articles AZOP relied on in reaching this finding is not confirmed. The account available rests on press reporting of AZOP's own public statement about the case, not on the regulator's primary decision document, which has not been retrieved. This means the account here describes the substance of the finding as reported, while flagging that the exact legal basis cited by AZOP, and any further procedural detail the decision document would contain, remains outside the current evidence base.

The case sits within a broader pattern noted elsewhere: AZOP's enforcement attention to biometric-processing design overlaps in subject matter, though not directly in substance, with the European Data Protection Board's own contemporaneous attention to biometric and surveillance-adjacent technologies through its smart-glasses statement. Both reflect a regulatory environment in which biometric processing design, encompassing both the scope of data collected and the structure of consent obtained for it, has become a specific area of scrutiny.

Outlook

Retrieval of AZOP's own decision document would materially sharpen understanding of this case, in particular the specific GDPR article or articles cited, the date of the decision itself, and whether it is subject to appeal. Until that document is available, the account of the operator's controller-duty failures rests on secondary characterisation rather than the primary enforcement text.

Controller/Processor Duties

AZOP's fine against a gambling and casino operator, issued 2 October 2026 at EUR 2,590,000, centres on a controller-processor duty failure around biometric data minimisation. The operator had disclosed to data subjects that it would collect two fingerprints for biometric identification purposes but in fact collected four, a discrepancy that AZOP's decision found exceeded what was necessary for the stated identification purpose and was not supported by valid consent. This is a confirmed finding under a decision directly reported by a national outlet and corroborated by a specialist compliance publication.

The same decision identified further controller-duty deficiencies beyond the biometric-collection discrepancy itself. AZOP found that the operator's consent mechanism bundled multiple distinct processing purposes together without giving data subjects a separable choice between them, a structure that is widely understood under GDPR to undermine the specificity requirement for valid consent. The decision further found that the privacy information the operator provided to data subjects was incomplete, inaccurate, and in places contradictory, compounding the consent deficiency with a parallel transparency failure. Together, these findings describe a controller whose data-protection documentation and consent architecture failed on multiple, mutually reinforcing grounds rather than on a single isolated point.

The scale of the fine, at EUR 2.59 million, situates this decision within a broader pattern of AZOP enforcement activity. It follows a EUR 1.5 million fine against a bank in December 2025 for processing mobile-banking users' data without a legal basis, indicating that AZOP is prepared to impose substantial penalties for controller-duty failures across different sectors, not only where biometric data specifically is involved.

Outlook

The specific reference number or AZOP's own press release for this decision was not located this cycle, which limits the ability to confirm further procedural detail such as whether the operator has indicated an intention to appeal. Given the pattern of escalating fine amounts evident in AZOP's recent enforcement record, further controller-duty decisions of comparable scale are a plausible continuation of the current trajectory, particularly where biometric or other special-category data processing is involved.

Controller/Processor Duties

AZOP's 2 October 2026 decision against an unnamed gambling operator includes a finding on transparency and accountability, separate from its consent and biometric findings. The decision found that the operator had presented incomplete and internally inconsistent information about the purposes and legal bases for its processing, contrary to the transparency principle and the information duties that controllers owe data subjects about what is being processed and why.

The significance of this finding lies in what internal inconsistency in a controller's own documentation reveals. Where a controller cannot present a coherent account of its own legal bases for different processing activities, that inconsistency is itself treated as an accountability failure, independent of whether any single processing activity considered in isolation might otherwise have had a defensible basis. AZOP's finding here therefore reaches the controller's governance of its own documentation and disclosure practices, rather than only the substance of what was disclosed.

This accountability finding sits alongside the operator's consent and biometric failures as part of the same decision, and reinforces a reading of the case as one where the operator's internal governance of its data-processing programme, not merely a single discrete practice, fell short of GDPR requirements. The combination of an incomplete information architecture with substantive consent and data-minimisation failures suggests a controller whose accountability documentation had not kept pace with the scope of its actual data-processing activity.

Outlook

The transparency and accountability finding is likely to be read by other Croatian controllers, particularly those in regulated sectors handling sensitive identity data, as a signal that AZOP will scrutinise the internal consistency of a controller's documented legal bases, not only the user-facing adequacy of its privacy notices. Whether this finding is separately contested on appeal, alongside the consent and biometric findings, remains to be seen.

Controller/Processor Duties

AZOP's 2025 enforcement record is reported to treat organisational governance failures as aggravating factors in penalty calculation rather than as freestanding violations alone. In a EUR 4.5 million fine against a telecom operator, secondary reporting indicates that AZOP counted the controller's disregard of its own data protection officer's explicit warning about excessive data collection, together with a failure to adequately vet a telemarketing processor's security measures, as factors that increased the severity of the eventual penalty. This is reported via VinciWorks' analysis of the case rather than confirmed directly from AZOP's own decision text, so the finding is understood at Probable confidence.

The structural significance, if the reporting holds, is that AZOP's enforcement approach extends beyond assessing whether a breach occurred to assessing whether internal governance mechanisms, specifically DPO independence and processor due-diligence, functioned as GDPR requires. A controller that received and ignored its own DPO's warning is treated more severely than one that had no such warning at all, and a controller that failed to scrutinise a processor's security posture before engaging it is treated as having failed its own Article 28 due-diligence obligation independently of whatever the processor itself did wrong.

No primary AZOP decision document for this case was directly retrieved this cycle; the quantum, the specific aggravating-factor reasoning, and the full facts rest on CMS Law and VinciWorks secondary analysis. This is a material gap for any controller seeking to calibrate governance practice precisely against AZOP's actual enforcement reasoning.

Outlook

The question to track is whether AZOP's underlying decision becomes publicly available in full, which would allow confirmation of exactly how DPO-disregard and processor-vetting failures were weighted in the final penalty, and whether this reasoning recurs in subsequent AZOP decisions against other controllers.

Sectoral Watch

Two distinct sectoral developments are in view for Croatia this cycle. The first concerns the education sector, where AZOP initiated an urgent supervisory procedure over CARNET following a data breach involving the personal data of students and teachers, understood to have begun around 15 June 2026. This is a probable, rather than fully confirmed, development, reflecting a notable supervisory response specifically within the education and research-network sector, an area that has not previously generated significant visible AZOP enforcement activity in available reporting.

The second development is adjacent to data protection but sits within the Digital Services Act framework: the European Commission sent Croatia an additional letter of formal notice on 29 April 2026, citing Croatia's continued failure to empower its Digital Services Coordinator and the presence of penalty provisions in national law that do not comply with DSA requirements. This is a confirmed development sourced directly to the Commission's own announcement. While this sits within platform-governance and digital-services regulation rather than core GDPR enforcement, it bears on the institutional capacity of Croatia's wider digital-regulation architecture, within which AZOP itself operates as the data protection component.

Taken together, these two developments illustrate sectoral pressure points distinct from AZOP's financial-sector and biometric-processing enforcement activity: an active supervisory response in education, and an unresolved institutional gap in digital-services governance flagged by the European Commission. Whether Croatia's Digital Services Coordinator has since been formally empowered following the Commission's letter was not established this cycle.

Outlook

The CARNET supervisory procedure may produce a further enforcement decision or published outcome in a subsequent cycle, which would clarify both the scope of the breach and AZOP's response to it. On the Digital Services Act front, confirmation of whether Croatia has since empowered its Digital Services Coordinator in response to the Commission's formal notice would resolve an open institutional question, though that question sits principally within platform-governance monitoring rather than within this sectoral-watch assessment itself.

Sectoral Watch

Croatia's financial sector faced continued AZOP scrutiny this cycle. A bank is reported to have been fined EUR 1.5 million for processing personal data belonging to 433,922 users without a valid legal basis, arising from software embedded in the bank's mobile-banking applications. This is reported via a&s Adria Magazine rather than confirmed directly from AZOP's own decision text, placing the finding at Probable confidence, though the scale of both the fine and the affected-user count is specific enough to suggest a substantive underlying case rather than a minor administrative matter.

The legal-basis failure at the centre of this case, embedded software processing personal data absent a valid GDPR Article 6 basis, points to a recurring sectoral risk in financial-services mobile applications: third-party or embedded software components processing customer data in ways the controller bank may not have fully mapped or assessed before deployment. Separately, reporting also references a fine involving the Croatian Insurance Bureau and a sports-betting company, though the facts of that action were not independently detailed in the evidence reaching this cycle beyond its mention.

Taken together, these actions indicate AZOP maintaining active sectoral attention on financial services and gambling-adjacent industries specifically, rather than treating GDPR enforcement as evenly distributed across the economy. No primary AZOP decision text was retrieved for either action this cycle.

Outlook

Watch for confirmation of the facts underlying the Croatian Insurance Bureau and sports-betting company fine, and for whether AZOP's mobile-banking-app scrutiny extends to other banks operating comparable embedded third-party software in Croatia.

Algorithmic, Biometric & Surveillance Governance

Two developments, one domestic and one at EU level, converge on biometric and surveillance governance in Croatia this reporting period. Domestically, AZOP fined an unnamed gambling operator approximately EUR 2.59 million for unlawfully processing biometric fingerprint data from casino players, a finding that rests specifically on the operator's biometric-identification design: collecting four fingerprints per player without demonstrating the necessity of collecting all four, alongside consent forms that impermissibly bundled multiple processing purposes together. Consent records existed for 34,933 players, underscoring that this was an established, scaled biometric-processing operation rather than a pilot or limited trial.

At EU level, and connected to Croatia through AZOP's own institutional participation, the European Data Protection Board adopted a statement on smart glasses and published a report titled The Connected Gaze at its latest plenary, reported 13 October 2026. AZOP's Deputy Chair, Zdravko Vukić, participated in that plenary. The statement and accompanying report address the surveillance, video-recording and evidence-handling implications that smart-glasses technology raises, a distinct but adjacent biometric-and-surveillance governance concern from the fingerprint-processing case, in that it concerns ambient recording and image capture rather than biometric identifiers collected directly from identified individuals.

The combination of these two developments, a concrete domestic enforcement action against biometric identification practices and direct Croatian institutional participation in an EU-level policy statement on a different but related surveillance technology, signals heightened regulatory attention to biometric and surveillance-adjacent data processing both within Croatia and at the European level during this period. The domestic enforcement action demonstrates that AZOP is prepared to act against established biometric-processing practices that fail to meet necessity and consent-granularity standards, while the EDPB statement demonstrates that the policy conversation around newer biometric-adjacent and surveillance technologies, such as smart glasses, is actively developing at the European level with Croatian regulatory participation.

It is worth noting what is not established by the evidence available: there is no finding connecting the gambling operator's fingerprint-processing practices to the EDPB's smart-glasses statement, and the two developments should be read as parallel signals of regulatory attention to biometric and surveillance technology generally, rather than as connected elements of a single regulatory action.

Outlook

Given AZOP's demonstrated willingness to enforce against biometric-processing design failures domestically, and its direct institutional engagement with the EDPB's developing position on smart-glasses surveillance technology, further Croatian regulatory attention to biometric and surveillance-adjacent processing, whether through additional enforcement action or through domestic guidance responsive to the EDPB's EU-level statement, is a plausible direction for this area going forward.

Algorithmic, Biometric & Surveillance Governance

AZOP's EUR 2.59 million fine against a gambling and casino operator is, at its core, a biometric-governance enforcement action: the operator was found to have collected four fingerprints for biometric identification purposes when only two had been disclosed to data subjects, exceeding what AZOP found necessary for the stated purpose and lacking valid consent. This confirmed decision demonstrates that AZOP is prepared to scrutinise the specific technical scope of biometric data collection against what was actually disclosed to data subjects, rather than assessing biometric processing only at the level of general lawfulness.

Running in parallel with this enforcement action, AZOP began implementing the 2026 European Data Protection Board Coordinated Enforcement Framework (CEF 2026), which this year focuses on GDPR Articles 12 to 14 transparency obligations, with a scope explicitly including AI systems and higher-education-institution transparency practices. A questionnaire response under this framework was due 15 July 2026. This is a confirmed, active coordinated-enforcement exercise that extends AZOP's governance attention into algorithmic and AI-system transparency specifically, beyond the biometric-processing enforcement evidenced by the gambling-operator fine.

Together, these two developments indicate that AZOP's attention to algorithmic and biometric governance is proceeding on two fronts simultaneously: a domestic enforcement action targeting excess biometric data collection, and participation in an EU-coordinated exercise examining transparency specifically in relation to AI systems and the higher-education sector. This dual-track activity suggests a supervisory authority engaging both with individual enforcement matters and with structured cross-border coordination exercises on algorithmic governance within the same period.

Outlook

The outcome of the 2026 CEF exercise on Articles 12 to 14 transparency, once published by the EDPB or by AZOP itself, would be the most informative next development in this area, potentially revealing findings specific to AI-system transparency practices among Croatian controllers. Separately, whether the biometric-collection enforcement approach evidenced in the gambling-operator decision is applied to other sectors using biometric identification remains an open question for subsequent cycles.

Algorithmic, Biometric & Surveillance Governance

AZOP's 2 October 2026 decision against an unnamed gambling operator establishes an applied precedent on biometric data-minimisation necessity testing in a commercial access-control setting. The operator had collected four fingerprints per player, two from each hand, for identification purposes, despite representing to users that it collected only two. AZOP found that the operator could not demonstrate that the larger scope of biometric collection was necessary for its stated identification purpose, and specifically that a justification resting on needing a backup fingerprint, without further substantiation, does not satisfy the necessity test. The fine attached to this finding, within the EUR 2,590,000 total, affected 34,933 players, giving the decision a scale that extends its relevance well beyond the single operator concerned.

The necessity-testing standard applied here is significant for any Croatian controller using biometric identification for commercial access control, identity verification, or similar purposes. It establishes that the stated purpose for biometric collection constrains the scope of what may be collected, and that scope creep beyond what was represented to users, even where framed as a backup or redundancy measure, requires its own independent necessity justification. A controller cannot rely on operational convenience or system-design preference alone to justify collecting more biometric data points than its disclosed purpose requires.

This is a comparatively underdeveloped area of enforcement precedent in Croatia, and the decision gives AZOP's approach to biometric proportionality a concrete, commercially-grounded reference point. Gambling operators specifically, who commonly deploy biometric identification for age verification and self-exclusion enforcement, are a natural audience for this standard, but the necessity-testing logic articulated is not sector-limited on its face.

Outlook

Controllers across sectors using biometric data for identification or access-control purposes in Croatia now have a concrete applied benchmark against which to test their own data-minimisation justifications. Whether AZOP extends this necessity-testing approach to other biometric use cases, such as workplace access control or video surveillance with facial-recognition elements, beyond the gambling-sector context of this decision, is a question this cycle's material does not resolve.

Algorithmic, Biometric & Surveillance Governance

AZOP is reported to have issued guidelines for AI systems involving personal data, emphasising GDPR compliance and risk assessment as the operative framework for controllers deploying AI. The regulator is also reported to have published FAQs addressing legal bases and individual rights specifically in the AI context. Neither the guidelines nor the FAQ document was independently retrieved from a primary AZOP publication this cycle; the finding rests on DataGuidance's aggregator-level summary, which caps confidence at Uncertain rather than Probable or Confirmed.

If the reporting is accurate, this represents Croatia's first documented move toward AI-specific data-protection guidance at the national level, distinct from the general GDPR framework that already applies to any personal-data processing regardless of whether AI is involved. The content of the guidance, specifically what risk-assessment methodology AZOP recommends and how it maps GDPR legal bases onto AI use cases, is not established in the evidence reaching this cycle beyond the general description that it exists and covers these topics.

This is properly read as an emerging rather than settled governance posture. Reports suggest AZOP may have engaged in international coordination on AI and data protection questions, though the specifics of any such coordination were not corroborated by a primary source this cycle and are not asserted here beyond that caveat.

Outlook

The priority for the next reporting period is direct retrieval of AZOP's actual AI guidance document and FAQ text, which would allow this module to move from an aggregator-sourced Uncertain finding to a properly sourced Confirmed or Probable assessment of Croatia's AI-specific data-protection posture.

Enforcement & Redress

AZOP's enforcement record over the past year shows an escalating pattern of substantial financial penalties across different sectors. The most recent confirmed action is the EUR 2,590,000 fine against a gambling and casino operator, issued 2 October 2026, for unlawful biometric fingerprint collection exceeding disclosed scope and lacking valid consent, compounded by a bundled consent mechanism and incomplete, inaccurate, and contradictory privacy information. This fine follows a EUR 1.5 million penalty AZOP imposed on a bank on 18 December 2025 for processing the personal data of 433,922 mobile-banking users without a legal basis. Both decisions are confirmed and together establish a clear and growing trend in the scale of AZOP's enforcement activity against different categories of controller.

Beyond financial-penalty decisions, AZOP's enforcement and redress activity this cycle also includes a probable supervisory procedure opened over a data breach at CARNET affecting students' and teachers' personal data, and participation in the 2026 EDPB Coordinated Enforcement Framework exercise on GDPR transparency obligations, with a questionnaire response due 15 July 2026. These represent two additional, confirmed-to-probable avenues of enforcement and redress-adjacent activity running alongside the headline financial penalties.

The pattern across these developments, read together, is one of an increasingly assertive national supervisory authority willing to impose seven-figure fines on both financial-sector and biometric-data violations, to open urgent supervisory procedures in response to sector-specific breaches, and to participate actively in EU-coordinated enforcement exercises. This is a materially different enforcement posture from one in which fines are occasional or modest in scale.

Outlook

Given the escalating trend in fine amounts evidenced across the gambling-operator and bank decisions, further large AZOP enforcement decisions are a plausible continuation of the current trajectory. The CARNET supervisory procedure's eventual outcome, and any published results from the 2026 EDPB Coordinated Enforcement Framework exercise, are both potential sources of further enforcement-and-redress signal in subsequent reporting.

Enforcement & Redress

AZOP's EUR 2,590,000 fine against an unnamed gambling operator, issued 2 October 2026, is among the largest penalties on record for Croatia's data protection authority. Third-party commentary, resting on a single uncorroborated source, states that AZOP issued 32 administrative fines totalling EUR 3.1 million between 2020 and the period before October 2026, with the largest prior single fine being EUR 2.26 million against B2 Kapital. If that figure is accurate, the October 2026 fine against the gambling operator alone approaches or exceeds the combined total of AZOP's enforcement activity across the preceding six years, though this comparison should be treated with appropriate caution given its single-source basis.

The fine was issued under the statutory maximum framework set by GDPR Article 83(4) to (6), under which administrative fines may reach up to EUR 10,000,000 or 2% of total worldwide annual turnover for lower-tier breaches, and up to EUR 20,000,000 or 4% of turnover for higher-tier breaches, a category that includes unlawful special-category processing and consent-principle violations, both of which were found in this decision.

This fine does not stand alone. It follows a December 2025 fine of EUR 1,500,000 against Erste Bank connected to a mobile-banking fraud-detection tool, and a separate February 2026 fine against a Zagreb credit institution for breach of the data subject's right of access under Article 15(3). Read together, these three enforcement actions across roughly a twelve-month span describe AZOP directing escalating attention toward the financial and gambling sectors specifically, sectors whose business models depend on processing sensitive customer-identification and financial data at scale.

Whether the gambling operator's fine will be appealed, and whether AZOP will publicly confirm the operator's identity, both remain open questions as at this writing. The scale of the fine, whichever of the available historical comparisons is used, marks a materially more assertive enforcement posture than AZOP's prior pattern of activity.

Outlook

The near-term question is less whether this fine stands as an outlier and more whether it marks a sustained new enforcement baseline for AZOP, particularly toward the financial and gambling sectors following the Erste Bank and Zagreb credit institution actions earlier in the same twelve-month window. An appeal, if filed, would test the necessity-testing and consent-bundling reasoning underlying the decision, with consequences for how firmly other Croatian controllers can rely on the precedent this decision sets.

Enforcement & Redress

AZOP confirmed directly, via its own website, that it imposed an administrative fine of EUR 100,000 on a real estate agency on 19 February 2026 for processing contrary to GDPR provisions. This is the single most directly evidenced enforcement action reaching this cycle, sourced from AZOP's own publication rather than secondary reporting, and it sits within a considerably larger reported enforcement pattern: AZOP is understood to have imposed nearly EUR 7 million in fines during 2025 as a whole, following what is described as a record EUR 10.5 million across 97 decisions in 2024. Both aggregate figures rest on a T4 aggregator source rather than an AZOP-published enforcement report, so they are treated as Uncertain rather than Confirmed, even though the February 2026 individual fine is itself Confirmed.

Beyond the aggregate volume, AZOP is reported to have launched a 2026 coordinated enforcement action alongside the European Data Protection Board focused on transparency, and to have opened a supervisory procedure over CARNET following a data breach affecting students and teachers. Neither the outcome of the EDPB-coordinated action nor the resolution of the CARNET procedure is established in the evidence reaching this cycle; both are open, active matters rather than concluded enforcement outcomes.

Taken as a whole, the picture is of a data-protection authority maintaining a high enforcement tempo across multiple concurrent tracks, sectoral fines, individual enforcement decisions, and participation in EU-wide coordinated actions, though the precision of the aggregate figures depends on AZOP publishing its own annual enforcement report, which was not directly retrieved this cycle.

Outlook

The outcome of the CARNET supervisory procedure and the EDPB coordinated transparency action are the two concrete developments to track into the next reporting period; either reaching a public resolution would convert an open enforcement track into a documented outcome.