Croatia: Issued ruling in AZOP Investigation into B2 Kapital regarding unauthorised data processing

On 4 May 2023, the Croatian Personal Data Protection Agency (AZOP) issued a ruling in its investigation into debt collection agency B2 Kapital d.o.o. The investigation was based on an anonymous complaint that the agency had illegally processed the personal information of natural persons with outstanding debts. AZOP found a number of violations, including the failure to notify data subjects of processing, failure to conclude a contract to conduct such processing, and failure to take adequate security measures, and issued a EUR 2.26 million fine as a result.