Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures
A Croatian gambling operator was fined €2.59 million after AZOP found it had processed biometric data — including fingerprints and photographs — without obtaining valid, specific consent from individuals. The operator compounded the violation by bundling multiple, unrelated processing purposes into single blanket consent statements, which is explicitly prohibited under GDPR's requirement for granular, informed consent. Incomplete and inconsistent privacy notices further obscured individuals' rights, and the failure to clearly link legal bases to specific processing activities demonstrated a systemic lack of data governance maturity. This case highlights that special-category data such as biometrics demands the highest standard of lawful processing, and that vague or omnibus consent mechanisms will not satisfy regulators.
Tactical Insight
Immediate actions
- Audit all existing consent mechanisms to ensure each processing purpose has its own distinct, unambiguous consent statement.
- Suspend or remediate any processing of biometric or other special-category data where a clear, documented lawful basis cannot be immediately confirmed.
Data governance improvements
- Maintain a comprehensive Record of Processing Activities (RoPA) that explicitly maps each processing activity to its specific legal basis under GDPR Article 6 and Article 9.
- Appoint or empower a qualified Data Protection Officer (DPO) to review and approve all data collection practices, especially those involving biometric data.
- Conduct a Data Protection Impact Assessment (DPIA) for any processing of biometric or sensitive personal data before deployment.
Training & compliance monitoring
- Train marketing, product, and legal teams on the distinction between consent, legitimate interest, and contractual necessity as GDPR lawful bases.
- Schedule quarterly internal audits of privacy notices to verify they are complete, accurate, and consistent across all customer touchpoints.
- Establish a regulatory change monitoring process to track guidance from national supervisory authorities and the EDPB.