Croatian SA Imposes an Administrative Fine of EUR 5,470,000.00 on the Debt Collection Agency EOS Matrix for Infringement of certain Articles of the GDPR

According to the judgment, on 22 March 2023, the Croatian Supervisory Authority (SA) was informed by the debt collection agency (the data controller) EOS Matrix d.o.o. of the unauthorized processing of a large number of personal data of natural persons. Accordingly, it was also stated that 294 natural persons in the database were minors at the time the database was compiled.

In the decision subject to the penalty, the following points were mentioned in summary;

• When processing data, the controller did not implement technical measures in the main database where the personal data of approximately 370,000 data subjects are processed. This was found to be in breach of Article 32 of the GDPR.
• During the audit activity, the controller also processed personal data of persons who are not the legal representatives of the debtor or heirs and there was no legal basis for this processing within the meaning of Article 6(1) of the GDPR.
• In the period from May 2018 to January 2019, the controller processed the data of 49,850 data subjects by recording telephone conversations without establishing the legal basis referred to in Article 6(1) of the GDPR, which led to a violation of Article 5(2) of the GDPR.

As a result, according to the Decision, the Croatian SA imposed an administrative fine of EUR 5,470,000.00 on the data controller, the Debt Collection Agency EOS Matrix d.o.o., for infringements of Articles 5, 6, 9, 12, 13, and 32 of the GDPR.

You can access the full text of the press release here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr