The Agency for the Protection of Personal Data (AZOP) of Croatia has issued an opinion clarifying the distinction between the right of access to public information and the right of access to personal data, in the context of a parental request addressed to a school.

Seized by a primary school regarding a parent's request to access the file of their child with a disability, the authority specified that this procedure mainly falls under the right of access provided in Article 15 of the GDPR. The parent, as the legal representative, has the right to access their child's data, including assessments, grades, and professional reports. However, this right is not absolute; the school must protect the rights of third parties by masking the personal data of other students or staff before any communication. Access may be restricted if disclosure violates specific legal obligations, such as professional secrecy or the protection of psychodiagnostic tools, or poses a risk to the child. Any refusal must be justified and proportionate. The authority emphasizes that the presence of sensitive data, such as health-related data, requires enhanced security measures but does not in itself justify a refusal of access.