The European Gaming and Betting Association (EGBA) is committed to protecting the personal data of players and ensuring that their privacy rights are respected. In order to do so, we have adopted a Data Protection Code of Conduct which all our members must follow.
This Code sets out the standards that we expect our members to meet in relation to data protection, including the lawful basis on which they can collect and process personal data, the need for consent, transparency, data minimization, storage limitation, data portability, profiling, and automated decisions, as well as data sharing and transfers.
The Code also contains several case studies illustrating how our members have applied these principles in practice.
We believe that this Code will guide our members to comply with their obligations under the General Data Protection Regulation (GDPR) and other applicable data protection laws.
It is important to note that this Code is not exhaustive and that our members are expected to adhere to all applicable data protection laws and regulations.
Lawful basis
Under the GDPR, all processing of personal data must be carried out on a lawful basis. The most relevant basis for the processing of personal data by online gambling companies, such as Tropicana Casino USA, is the data subject’s consent.
To rely on consent as a lawful basis for processing, our members must ensure that they meet the requirements set out in Article 4(11) of the GDPR. In particular, they must ensure that:
- The data subject has been informed that their personal data will be processed for a specific purpose;
- The data subject has given their free, specific, informed, and unambiguous consent to the processing of their personal data for that purpose; and
- The data subject has been informed that they have the right to withdraw their consent.
Consent
For consent to be valid, it must be given by a data subject of legal age and capacity to do so. In addition, our members must ensure that they obtain consent from the data subject in a form that is clearly distinguishable from other matters, such as terms and conditions.
It is important to note that members can withdraw consent at any time and that our members must ensure that they provide data subjects with an easy way to do so.
Legitimate interests
Another lawful basis that may be relevant for online gambling companies’ processing of personal data is legitimate interests.
To rely on legitimate interests as a lawful basis for processing, our members must ensure that they meet the requirements set out in Article 6(1)(f) of the GDPR. In particular, they must ensure that:
- The processing is necessary for the legitimate interests pursued by our members or by a third party; and
- The legitimate interests of our members or a third party are not overridden by the interests or fundamental rights and freedoms of the data subject.
Special category data
Under the GDPR, special category data can only be processed on a limited number of lawful bases, including with the explicit consent of the data subject or where it is necessary to carry out our members’ obligations under employment, social security, or social protection law.
Transparency
Our members must ensure that they are transparent about the processing of personal data and provide data subjects with clear and concise information about their rights.
In particular, our members must ensure that they:
Provide data subjects with a privacy notice that sets out the specific purposes for which their personal data will be processed;
- Inform data subjects of their right to withdraw their consent at any time;
- Ensure that data subjects can access their data easily; and
- Allow data subjects to contact them to exercise their rights.
Data minimization
Our members must ensure that they only collect and process the necessary personal data for the purposes for which it is being processed.
In particular, our members must ensure that they:
Limit the collection of personal data to that which is necessary for the purposes for which it is being processed;
- Delete or destroy personal data that is no longer necessary for the purposes for which it was collected; and
- Do not process personal data for any purpose other than it was collected.
Data accuracy
Our members must take reasonable steps to ensure that the personal data they process is accurate and up-to-date. In particular, our members must ensure that they:
- Take reasonable steps to verify the accuracy of any personal information they process; and
- Update their records if they become aware of any changes to their personal data.
Security
It is also an obligation under the GDPR to take “reasonable measures” to safeguard personal data they handle from loss, damage, misuse, unauthorized access, or disclosure. Just make sure to:
- Protect their systems and data with appropriate technical and organizational measures;
- Restrict access to personal data to those employees, contractors, and other persons who need access for the purposes for which it is being processed;
- Ensure that personal data is transmitted securely; and
- Destroy or pseudonymous personal data when it is no longer needed.
Data protection is essential for online gambling because it ensures that personal data is only collected and processed for its intended purposes. In addition, it provides data subjects with clear information about their rights and how
Access to personal data
When it comes to gambling, one of the critical things is that players need to feel comfortable knowing that their data is safe and secure. Data protection is vital for online gambling operators as it ensures that players can trust them to handle their information responsibly.
Data protection is essential for online gambling because it ensures that personal data is only collected and processed for its intended purposes. In addition, it provides data subjects with clear information about their rights and how their personal data will be used.
This helps create a safe and secure environment for online gambling that players can trust.
Operators who fail to comply with data protection regulations can face severe penalties, including fines of up to 20 million euros or 4% of their global annual turnover, whichever is greater. This clarifies that online gambling operators should not take data protection lightly.
