When you sign up with an online casino, you’re not just risking your cash – you’re entrusting sensitive personal information to an organisation whose agenda might be other than to protect your information. From passport copies to bank information, web gambling websites receive all manner of personal information. What becomes of it after they’ve gotten their hands on it? We get mail from players regularly that is concerned that their information is forwarded or sold without permission. What we are going to do here in this guide is examine a bit closer what rights you have under UK data protection law, how casinos are allowed to forward your information, and what you can do if you believe your privacy has been violated.
What Personal Data Do Online Casinos Collect?
Online gambling platforms usually collect more personal information than most Internet services. This typically includes the following:
- Personal Information – Full name and address, date of birth, Email address and phone number, IP address, and location info.
- Financial information – Payment card information, bank account information, transaction history, withdrawal and deposit habits.
- Behavioural information – Game played and betting patterns, length of gambling, login date and frequency, device information, and browser type.
- KYC documents – Passport or driving license photocopies, utility bills or bank statements, proof of income, and selfie or video verification.
Operators need to verify your ID to prevent fraud, money laundering, and underage gambling. However, this vast amount of private information is a pressing privacy concern. For more on how to safeguard your data across gambling platforms, see our article: Your Data, Your Rights: How to Keep Your Personal Information Safe on Gambling Sites.
Can Online Casinos Legally Sell or Share Your Data?
Under the UK GDPR and the Data Protection Act 2018, online casinos are not at liberty to sell your data to the highest bidder. They must have legal grounds for any data processing action, including sharing with third parties. The majority of operators, though, share user information with:
- Payment processors and fraud protection agencies
- Marketing partners and affiliates
- Analysis firms and software providers
- Other organisations in their group
Even though there is data sharing which is for business purposes, the distinction between legal sharing and invasion of privacy boils down to:
- Transparency – was disclosure of data sharing made?
- Consent – did you specifically opt in for it?
- Purpose – is the data being utilised for its intended purpose?
Most casinos make this important information hard to find in long privacy policies that nobody pays attention to. That makes your data technically shared „with consent,“ but that consent was not informed or freely given.
What the Law Says: Understanding Your Rights
UK data protection law gives you some rights when it comes to your data:
- Right to be informed: Online casinos must tell you in clear language how they collect, use, and share your information. This should be easily accessible before you provide any personal information.
- Right of access: You can ask for a copy of all personal information a casino maintains on you through a Subject Access Request. The operator must respond within one month.
- Right to erasure: Also known as the “right to be forgotten,” this allows you to request your data to be deleted when there is no compelling reason for continued processing.
- Right to object: You can object to your data being processed for direct marketing or profiling. Casinos must stop using your data for these purposes as soon as you object.
- Right to data portability: You have the right to request your data in a portable format to transfer to another service.
- Right to restrict processing: In certain cases, you can request a casino to restrict what it can do with your data.
Red Flags: Signs Your Data May Be Misused
We are going to recommend what you have to watch out for when your data has been sold or inappropriately used. Firstly, pay attention if you are receiving gambling marketing messages from businesses you have never signed up with, as well as receiving targeted gambling ads on different platforms you do not utilise. Also, if the spam calls on your mobile phone increase, there is a high chance that your data has been published or sold. You should take this as a warning when your account is receiving login attempts from unfamiliar locations, or the casino will not provide you with clear information regarding its data policy whenever you request it.
These signs don’t necessarily indicate illegal sharing of data, but they do deserve to be looked into.
What to Do if You Suspect a Privacy Breach
If you think that an online gambling platform has given away your details, do not worry. We are going to provide a step-by-step guide on what to do in this case:
- First, we think that it is important to file an official complaint via the casino’s customer support department, making clear that the concern is one of data protection.
- Then you should ask for a full copy of your data and to whom it has been distributed.
- Whenever they answer you, formally ask the casino to stop processing your data for marketing purposes.
- Save all of the evidence, screenshot any suspicious activity, and record any abnormal communications.
- Complaint to the Information Commissioner’s Office, the UK data protection authority, if the casino does not resolve your complaint.
- Lastly, approach data protection lawyers who specialise in gambling cases for extreme breaches.
How Player Protection Legal Can Help
At Player Protection Legal, the team can specialise in helping players whose data rights have been exploited by online gambling platforms. The services from this special team include approaching the casino’s policies fully to identify potential GDPR violations, dealing with SAR, advising players on exercising their data protection rights effectively, investigating allegations of data sharing, representing players in data breach actions against the companies, and claiming damages for distress and financial loss for privacy violations.
Our lawyers have extensive experience in getting gambling companies to pay for the abuse of personal data. The team understands the specific problems in the industry for online gambling, where companies often operate across multiple jurisdictions.
We recommend that you keep your information safe when gambling online. Although the team is here to help you, it is always better to avoid such things from happening. To avoid such things, you need to follow these things:
- Read the Terms of Privacy
- Have separate email addresses for use on gambling accounts
- Utilise dedicated payment solutions
- Monitor your account for unusual activities
- Opt out of marketing messages
- Utilise strong, individual passwords for gambling sites
- Take note of casinos that are licensed in jurisdictions that have weak data protection
Final Thoughts
To sum up the information given above, your data is valuable and has to be guarded. Online gambling sites do have a genuine interest in collecting some data, but they have to do so responsibly and within the boundaries of the law. Operators are likely to take advantage of players’ trust or lack of knowledge of data protection rights. If you have been a victim of such situations, the staff of Player Protection Legal is committed to helping players stand up for their data rights. These specialists bring gambling regulation and data protection law expertise together to deliver specialist advice to players who are concerned about privacy. Remember that your information is yours, not the casino’s, and the law is on your side!