Croatian Gambling Operator Fined €2.59M for GDPR Biometric and Consent Violations

The gambling operator violated multiple GDPR principles by collecting excessive biometric data (four fingerprints instead of the legally necessary two), bundling distinct processing purposes into single consent statements, and providing inconsistent and incomplete information to data subjects. These failures breach core GDPR principles of data minimisation (Article 5(1)(c)), purpose limitation (Article 5(1)(b)), and transparency (Article 13/14). The case demonstrates that organisations handling sensitive biometric data face heightened scrutiny and must ensure consent mechanisms are granular, lawful, and clearly documented. Without robust internal data governance processes, organisations risk significant financial penalties and reputational damage.

Tactical Insight

Immediate actions

Audit all biometric data collection processes to ensure only the minimum necessary data is collected in strict compliance with GDPR Article 5(1)(c).
Disaggregate bundled consent statements into separate, purpose-specific consent forms so data subjects can independently grant or withdraw each consent.

Policy and governance improvements

Appoint or empower a qualified Data Protection Officer (DPO) to conduct regular internal audits of data processing activities and consent mechanisms.
Maintain an up-to-date Record of Processing Activities (RoPA) under GDPR Article 30, documenting the legal basis, purpose, and data categories for every processing activity.
Establish a Privacy by Design framework requiring data minimisation and transparency reviews before any new data collection initiative is launched.

Training and awareness measures

Deliver targeted GDPR training to all staff involved in data collection, consent management, and customer communications to ensure consistent and accurate information is provided.
Implement periodic third-party privacy compliance assessments focused on high-risk processing activities such as biometric data handling.