Telecommunications Operator Fined €4.5 Million for GDPR Violations

The Croatian Personal Data Protection Agency levied a €4.5 million administrative fine against a telecommunications operator. This action followed ex officio proceedings which revealed multiple infringements of the General Data Protection Regulation by the operator, acting as a data controller. Key violations included the unauthorized transfer of personal data to third countries without proper legal instruments or transparent notification to data subjects, unlawful processing of employee identity cards and criminal background checks, and insufficient prior due diligence on a data processor.