The Croatian Data Protection Authority (AZOP) has initiated an ex officio investigation against CARNET following an unauthorized disclosure of personal data of students and teachers.
This procedure follows the unauthorized publication of personal data, including email addresses, belonging to students and teachers of Croatian schools. AZOP specifies that it did not receive a breach notification from the data controller within the 72-hour deadline provided by Article 33 of the GDPR. The authority also warned of the increased risk of phishing attacks and other online fraud targeting the data subjects. It issued recommendations, particularly aimed at parents, to raise awareness about security and encourage them to warn children not to open suspicious links or share their personal information.