Zdravko Vukić, director of the Croatian Personal Data Protection Agency

The Croatian Personal Data Protection Agency (hereinafter: the Agency) is the only independent public supervisory authority in the Republic of Croatia within the meaning of the provision of Article 51 of the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and the Act on the Implementation of the General Data Protection Regulation (Official Gazette, No. 44/2018) which was enacted on 25th May 2018 to ensure full implementation of the GDPR in Croatia.

Article 37 of the Constitution of the Republic of Croatia says that “Everyone shall be guaranteed the safety and secrecy of personal data. Without consent from the person concerned, personal data may be collected, processed and used only under conditions specified by law.
Protection of data and supervision of the work of information systems in the Republic shall be regulated by law.”

Since its establishment in 2004 by the Act on Personal Data Protection, the Agency has been making major efforts to raise awareness of the protection of personal data and to promote a fundamental human right – the right to protection of personal data.

According to its vision and mission, the Agency is raising awareness of all stakeholders, with the ultimate goal that the protection of personal data becomes a generally accepted principle among all entities who collect, process and transfer personal data.

The Agency is a supervisory authority in the Republic of Croatia, with over 15 years of experience, responsible for monitoring the application of the GDPR and the Act on the Implementation of the GDPR, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the EU. The Agency as a supervisory authority has investigative, corrective and advisory powers.

The Agency has experience in dealing with personal data breach notifications, performing complex supervision controls on the GDPR compliance and monitoring the level of implementation of the technical and organizational measures regarding personal data protection in organizations from the public and the private sector. The Agency as national supervisory authority actively participates in the work of the following Supervision Coordination Groups: Schengen Information System (SIS II), Visa Information System (VIS), Customs Information System (CIS), European Asylum Dactyloscopy Database (EURODAC), as well as in the work of the Europol Cooperation Board (ECB).

Anyone who considers that any of his or her rights guaranteed by the GDPR and the Act on the Implementation of the GDPR have been violated, may submit to the Agency a request for determination of a violation of a right. The Agency shall decide on the violation of rights by a ruling. The ruling of the Agency shall be an administrative act. No appeal shall be allowed against the ruling of the Agency, but an administrative dispute may be instituted by lodging a complaint before a competent administrative court.
If the ruling prescribes erasure or other irreversible removal of personal data, a dissatisfied party may request the competent administrative court to delay the erasure or other irreversible removal of personal data if he or she proves that it would involve a disproportionate effort to re-collect personal data whose erasure or irreversible removal has been requested.
If the competent administrative court accepts the request, the party who was ordered erasure or other irreversible removal of personal data must stop any processing of the disputable personal data, except their keeping, until the final court judgement is made.

The Agency shall impose administrative fines for breaches of provisions of this Act and the GDPR, in accordance with Article 83 of the GDPR. If the administrative fine is imposed on a legal person vested with public authority or on a legal person performing a public service, the imposed administrative fine shall not jeopardise the performance of such public authority or public service. In procedures conducted against public authorities, an administrative fine for a breach of this Act or the GDPR cannot be imposed on a public authority.
Administrative fines shall be imposed by a decision. No appeal shall be allowed against the decision, but an administrative dispute may be initiated before a competent administrative court.
Furthermore, the Agency issues recommendations and expert opinions regarding personal data protection and also provides training sessions and consultations to the private and the public bodies according to its capabilities and within its competence. This activities contribute to raising the quality of the enforcement of the GDPR and to strengthening public awareness on the measures that should be taken for proper protection of personal data.

The representatives of the Agency are active participants of the plenary meetings of the European Data Protection Board (EDPB), as well as members of the expert subgroups of the EDPB.
As a Member State of the Council of Europe, the Republic of Croatia has accepted provisions of the Convention 108 (Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data).

On the 14th of April 2005 the Croatian Parliament has ratified the Convention 108 (Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and Additional Protocol to the Convention for the Protection of Individuals with regard to automatic Processing of Personal Data regarding supervisory authorities and trans border data flows) (Official Gazette, No. 04/05).

The representatives of the Agency actively participate at the meetings of the Consultative Committee (T-PD) established by the Council of Europe, which is composed of representatives of Parties to the Convention complemented by observers from other States (members and non-members, government or data protection authority), international organisations and non-governmental organisations. It is responsible for interpreting the provisions of the Convention 108 and ensures to facilitate and improve its implementation.

Thanks to its regular and active participation on the international scene the Agency contributes to a continuous work development in the field of personal data protection to the harmonization of the Croatian legislation in the field of personal data protection with the highest European and international norms and standards and finally to meet obligations arising from the international conventions signed and ratified by the Republic of Croatia.

• monitor and enforce the application of the GDPR;
• promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing.  Activities addressed specifically to children shall receive specific attention;
• advise the Government of the Republic of Croatia, the Croatian Parliament and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to processing;
• promote the awareness of controllers and processors of their obligations under the GDPR and Act on the Implementation of the GDPR;
• upon the request, to provide information to any data subject concerning the exercise of their rights under the GDPR and Act on the Implementation of the GDPR, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
• handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 of the GDPR, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
• cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of the GDPR;
• conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
• monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
• adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2) GDPR;
• establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4) of the GDPR;
• give advice on the processing operations referred to in Article 36(2) of the GDPR;
• encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5) of the GDPR;
• encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5) of the GDPR;
• where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7) of the GDPR;
• conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43 of the GDPR;
• authorise contractual clauses and provisions referred to in Article 46(3) of the GDPR;
  • approve binding corporate rules pursuant to Article 47 of the GDPR;
• keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2) of the GDPR.
  The investigative powers of the Agency are to:
• order the controller and the processor, and, where applicable, the controller’s or the processor’s representative to provide any information it requires for the performance of its tasks;
• carry out investigations in the form of data protection audits;
• carry out a review on certifications issued pursuant to Article 42(7) of the GDPR;
• notify the controller or the processor of an alleged infringement  of the GDPR and Act on the Implementation of the GDPR;
• obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;
• obtain access to any premises of the controller and the processor, including to any data processing equipment and means.
  The corrective powers of the Agency are to:
• issue warnings to a controller or processor that intended processing operations are likely to infringe provisions the GDPR and Act on the Implementation of the GDPR;
• issue reprimands to a controller or a processor where processing operations have infringed provisions of the GDPR and Act on the Implementation of the GDPR;
• order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to the GDPR and Act on the Implementation of the GDPR
• order the controller or processor to bring processing operations into compliance with the provisions of the GDPR and Act on the Implementation of the GDPR, where appropriate, in a specified manner and within a specified period;
  • order the controller to communicate a personal data breach to the data subject;
  • impose a temporary or definitive limitation including a ban on processing;
• order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19 of the GDPR;
• withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43 of the GDPR, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;
• impose an administrative fine pursuant to Article 83 of the GDPR, in addition to, or instead of measures, depending on the circumstances of each individual case;
• order the suspension of data flows to a recipient in a third country or to an international organisation.
  The advisory powers of the Agency are to:
• advise the controller in accordance with the prior consultation procedure referred to in Article 36 of the GDPR;
• issue, on its own initiative or on request, opinions to the Croatian parliament, the Government of the Republic of Croatia and to other institutions and bodies as well as to the public on any issue related to the protection of personal data;
• authorise processing referred to in Article 36(5) of the GDPR, if the law of the MS requires such prior authorisation;
• issue an opinion and approve draft codes of conduct pursuant to Article 40(5) of the GDPR;
• accredit certification bodies pursuant to Article 43 of the GDPR;
• issue certifications and approve criteria of certification in accordance with Article 42(5) of the GDPR;
• adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2) of the GDPR;
• authorise contractual clauses referred to in point (a) of Article 46(3) of the GDPR;
• authorise administrative arrangements referred to in point (b) of Article 46(3) of the GDPR;
• approve binding corporate rules pursuant to Article 47 of the GDPR.
  According to the Article 6 of the Act on the Implementation of the GDPR, in addition to its powers laid down by the GDPR, the Agency shall perform the following duties:
• when laid down by a special law, it may initiate and has the right to participate in criminal, misdemeanour, administrative and other court and out-of-court proceedings for breaches of the GDPR and the Act on the Implementation of the GDPR,
• adopts the Criteria for determination of the amount of the compensation of administrative costs,
• publishes individual decisions on the Agency’s website in accordance with Articles 18 and 48 of Act on the Implementation of the GDPR,
• initiates and conducts appropriate procedures against responsible persons for breaches of the GDPR and Act on the Implementation of the GDPR,
• carries out its duties of the independent supervisory authority for monitoring the implementation of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, unless otherwise laid down by special regulations and carries out other duties laid down by law.
  Cooperation with state administration bodies and other bodies
  Central state administration bodies and other public authorities shall submit to the Agency the drafts of proposals of laws and proposals of other regulations governing issues related to personal data.

The Agency shall submit an annual report on its work to the Croatian Parliament, at the latest by 31 March of the current year for the previous year. The annual report shall contain information such as number of requests of data subjects and number of complaints, rulings issued on complaints of data subjects and ex officio, including the number of supervisory activities carried out, number of received reports from controllers on personal data breaches, supervisory activities, number of actions with respect to the code of conduct and certification, etc.