The Croatian Data Protection Authority (AZOP) issued an opinion regarding the disclosure of information on overtime payments to municipal agents, within the framework of a request for access to public documents.

Addressing the disclosure of agents' names, amounts paid, and reasons for these payments, the authority clarified that this information constitutes personal data. However, their disclosure is lawful as it is based on a legal obligation, pursuant to Article 6, paragraph 1, point c of the GDPR, in connection with the national law on access to information. The latter provides that information relating to the use of public funds, including remunerations, is accessible to the public. Therefore, employee consent is not required for this transmission. The municipality is required to provide existing documents justifying the overtime hours, without being obliged to create a new analysis.

AZOP emphasized that the data minimization principle of Article 5, paragraph 1, point c of the GDPR must be respected. Thus, while names, number of hours, gross amounts, and official reasons may be disclosed, all other irrelevant personal data (personal identification number, address, IBAN, tax or health information) must be redacted. The municipality, as the data controller, remains solely responsible for the exact scope of information to be disclosed, relying on the advice of its data protection officer.