A fine of €2.59 million was imposed on a gambling operator for processing the biometric data of its customers without a valid legal basis, in violation of the principles of data minimization and transparency.

Facts and context

The Agency for Personal Data Protection (AZOP), the Croatian authority, today published a sanction decision against a gambling operator, including the imposition of a €2,590,000 fine, for breaches related to the processing of biometric data.

The case originated from an ex officio investigation conducted by the authority concerning the company's player identification practices.

Grounds for the decision

• Obligation of lawfulness and data minimization (Article 5(1)(a) and (c), Article 6(1) and Article 9(1) of the GDPR): The data controller offered fingerprint identification to speed up player entry, as an alternative to identity card verification. The investigation revealed that the company collected fingerprints from four fingers, not two as claimed, for 34,933 players. The authority deemed this collection excessive for the identification purpose, rejecting the argument of needing "backup" fingerprints in case of skin injury. It recalled that processing violating the minimization principle cannot become lawful solely because the data subject consented, especially regarding biometric data whose processing presents a high risk.
• Obligation to obtain valid consent (Article 7 and Article 4(11) of the GDPR): The consent statements presented to players for collecting their fingerprints and photographs grouped several distinct purposes (identification, statistics, profiling, service improvement, etc.) without offering them the possibility to choose separately. Moreover, the wording caused confusion between legally mandatory processing (identity verification) and optional processing based on consent. The authority concluded that this bundled and unclear consent did not meet the requirements of specificity, freedom, and informed nature, rendering it invalid.
• Obligation of transparency and information (Article 12(1) and Article 13 of the GDPR): The information on data processing, scattered across several documents given to players, was incomplete, contradictory, and inconsistent. For example, the purposes associated with fingerprint collection varied from one document to another, and the legal bases were not clearly linked to specific processing activities. Consequently, data subjects could not clearly and unambiguously understand how their personal data were processed, violating the transparency principle.

Authority's decision

Consequently, the authority imposed a €2,590,000 fine on the gambling operator.

Lessons learned

This decision reminds that:

• A person's consent cannot make lawful processing that otherwise violates the data minimization principle, especially when it concerns sensitive data such as biometric data.
• Consent collection must be granular: grouping several distinct purposes within a single consent request without allowing separate choices invalidates the consent.
• The information provided to data subjects must be consistent and unambiguous across all media, clearly linking each processing purpose to its specific legal basis to ensure genuine transparency.