The High Administrative Court of Croatia upheld an HRK 675,000 fine for a retail chain
The full text of the judgment in our Judykatura database shows that internal rules governing access to CCTV do not release a controller from liability where they fail in practice to prevent the unauthorised use of footage. The judgment of the High Administrative Court of Croatia of 16 June 2026 confirms that Article 32 GDPR requires measures that mitigate risk even where the source of a breach is employees’ intentional conduct.
The rest of this analysis, all theses and the full text of the ruling are available with an AKTUALNOŚCI PLUS subscription.
Find out how EU supervisory authorities, administrative and civil courts and the CJEU reason their decisions — and keep your organisation aligned with current case law.