Croatian Gambling Operator Fined €2.59M for Biometric Data GDPR Violations
A Croatian gambling operator was fined €2.59 million after collecting biometric data — including fingerprints and photographs — without valid, granular consent, and gathering more data than operationally necessary. The operator compounded violations by bundling multiple processing purposes into single consent statements, obscuring what data subjects were actually agreeing to. Collecting four fingerprints while claiming only two were taken further demonstrated a lack of internal data governance controls. This case highlights that biometric data, as a special category under GDPR Article 9, demands heightened scrutiny, explicit consent, and strict data minimization practices. Failing to implement these safeguards exposes organizations to significant regulatory penalties and reputational damage.
Tactical Insight
Immediate actions
- Audit all existing consent mechanisms to ensure each processing purpose has a separate, explicit, and freely given consent statement.
- Conduct a data inventory review to verify that only the minimum necessary data is being collected and retained, especially for biometric categories.
Long-term improvements
- Implement a formal Data Protection Impact Assessment (DPIA) process for any processing involving biometric or special-category data before deployment.
- Establish a data minimization policy with technical controls that enforce collection limits defined in privacy notices.
- Appoint or empower a qualified Data Protection Officer (DPO) to continuously review processing activities against documented legal bases.
Detection & Monitoring
- Schedule periodic internal audits comparing actual data collection practices against documented privacy notices and consent records.
- Implement automated alerts for data collection volumes that exceed defined thresholds for sensitive or biometric data fields.