EOS Matrix, a Croatian debt collection agency, has been fined for non-compliance with the GDPR. In the line of business, a debt collector buys whole portfolios of NPL, non performing loans, from banks and other credit institutes.
All correspondence and all documentation about the loan is transferred from the seller to the buyer, and the number of loans can easily be hundred of thousands in one single portfolio.
The Croatian Supervisory Authority, AZOP, found that EOS Matrix had not control of the information contained in the portfolio received from the seller.
Firstly, EOS had not implemented sufficient technical measures to gain control of the information.
Secondly, personal data of persons who where not debtors was processed, which is normally what occurs in correspondence between individuals.
EOS also unlawfully processed health data and AZOP concluded that processing of health data was not described in the company’s privacy policy.
As a result of the non-compliance, EOS is fined €5 740 000, which must be considered a substantial fine considering the EOS relatively small presence on the Croatian market.
As a result of the decision, AZOP has also opened up for data subjects to claim damages, adding even more to the negative financial impact for EOS.
Control of information is central in the GDPR and an active inventory of information assets purchased, whether it’s a NPL portfolio or a whole company, is crucial to both assure and be able to prove compliance and abilities according to the GDPR.
Had EOS used Aigine to make an inventory of the assets received they would have been able to pro-actively take actions on all points brought forward by the Supervisory Authority.
