The enactment of the EU’s General Data Protection Regulation (GDPR) in May 2018 ushered in a new era of data privacy and protection laws. While primarily targeting tech giants like Google and Facebook, GDPR has also had a profound impact on the online casino industry. With potential fines running into the tens of millions for noncompliance, casino operators have been forced to overhaul their data and cybersecurity practices.
Security Ramping up
One of GDPR’s core principles is “privacy by design,” which calls for companies to integrate data protection features directly into products and services from the outset. For casinos, like Just Casino online, this has translated into large investments in cutting-edge cybersecurity tools and staff training to prevent data breaches.
Technologies being adopted include:
- End-to-end encryption to scramble customer data
- De-identification to anonymize information
- Stringent access controls around customer data
- Advanced malware, intrusion detection and DDoS attack prevention
Many operators now also employ dedicated cybersecurity specialists like Chief Information Security Officers (CISOs). Having robust defenses is imperative considering the rise of hacking attacks targeting the gambling industry in recent years.
Procedures for Notifying Breaches Should Be Strengthened
GDPR also introduced much tighter timelines for reporting eligible data breaches – no later than 72 hours after first becoming aware of an incident. This is significantly faster than most breach notification laws globally.
To meet these requirements, casinos have established around-the-clock security monitoring and response protocols. Teams of professionals are dedicated to quickly detecting, containing and investigating any potential unauthorized data access incidents.
If customer records are confirmed to have been compromised, GDPR-compliant notification policies enable promptly informing each affected individual within 72 hours. Such notices must also clearly describe the nature of the breach, likely consequences, steps being taken to mitigate damage and advice to help prevent identity theft or further harm.
Data Anonymization and Minimization
In line with “data minimization” principles, GDPR obligates companies to only gather customer information required for providing their services. Additionally, they must render data anonymous wherever feasible to prevent individual identification.
For online casinos, this means cutting back on unnecessary collection of details like full names, contact info, government IDs, bank account numbers and other sensitive identifiers. Only details strictly needed for real money account verification, processing payments and complying with anti-fraud and anti-money laundering regulations are obtained.
Various de-identification techniques are also applied to anonymize records stored in databases. This includes masking names, scrambling account numbers and truncating birthdates or addresses. Such measures ensure that even if systems were breached, individual user identities would remain protected.
Enhanced Transparency Around Data Usage
To provide customers better visibility and control around how their information is used, GDPR-compliant privacy policies and consent notices have become much more detailed. Gambling sites now clearly specify purposes like fraud prevention, geolocation, behavioral analysis, payments, responsible gaming limits, marketing etc. for gathering different data.
Casino members can also easily review their stored personal information through dedicated dashboard access and data download tools. Opt-out and deletion options are available for those wanting to revoke consent and erase certain details.
Overall, drastically increased transparency obligations have given users far more insight and autonomy over their data. This upholds GDPR’s core rights allowing people to access their information and restrict processing.
Sizable Fines Issued for GDPR Noncompliance
Thus far, GDPR enforcement has resulted in some sizable penalties being levied against gambling operators for privacy and security failings.
In 2019, the UK’s Information Commissioner’s Office (ICO) fined casino and bingo giant Jackpotjoy £3 million for leaving more than 21 million customer accounts exposed on improperly secured databases between 2017 and 2018. Similarly Sweden-facing operator Videoslots was fined £1.4 million by the Swedish Data Protection Authority for various GDPR violations uncovered in 2020.
Table: Major GDPR Fines Issued to Online Gambling Companies
| Company | Fine Amount | Reason | Year |
| Jackpotjoy | £3 million | Customer data exposed on unsecured servers | 2019 |
| Videoslots | £1.4 million | Improper storage, usage and deletion of customer data | 2020 |
While not specifically pertaining to casinos, the British Airways £20 million penalty in 2019 underscored authorities’ willingness to levy substantial fines – nearly 11 times Jackpotjoy’s amount.
With regulators closely monitoring the industry, operators neglecting compliance do so at great financial risk. However most have invested considerable resources specifically to mitigate this. Their commitment to upholding GDPR principles has bolstered cyber protections and given customers much more transparency and control around use of their information.
