The Croatian Data Protection Authority (AZOP) has reminded the obligations incumbent on a public institution considering publishing an audit report containing personal data.

Asked by a public institution about the publication of its 2024 audit report, which included data on employees, their salaries, and public contracts, the authority emphasized that the responsibility for the lawfulness of the processing lies with the controller under the accountability principle of Article 5, paragraph 2 of the GDPR. The institution must, before any decision, consult its data protection officer, whose designation is mandatory for public bodies according to Article 37, paragraph 1, point a) of the GDPR, and identify a valid legal basis under Article 6 of the GDPR. Even if a legal basis exists, it is imperative to assess the necessity and proportionality of disclosing each personal data. The public interest in transparency of fund usage does not justify full publication without applying the data minimization principle. Information not essential to the purpose of the publication, notably sensitive data about employees, must be anonymized or redacted.