Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection
A Croatian gambling operator was fined €2.59 million after collecting customer fingerprint data without valid legal basis, violating GDPR principles around lawful processing and informed consent. The operator compounded the violation by bundling multiple data processing purposes into a single consent statement, making it impossible for users to grant or withhold consent granularly. Incomplete and inconsistent disclosures to data subjects further undermined transparency obligations. This case underscores that biometric data — classified as a special category under GDPR Article 9 — demands the highest standard of care, explicit consent, and clear communication. Failure to meet these standards exposes organizations to significant financial and reputational damage.
Tactical Insight
Immediate actions
- Audit all biometric and special-category data processing activities to verify a valid legal basis exists for each purpose.
- Disaggregate bundled consent statements so data subjects can independently accept or reject each distinct processing purpose.
- Update privacy notices to ensure they are complete, consistent, and written in plain language accessible to all data subjects.
Long-term improvements
- Conduct a Data Protection Impact Assessment (DPIA) before deploying any biometric identification system, as required by GDPR Article 35.
- Establish a formal data governance policy that classifies biometric data as high-risk and mandates DPO sign-off before collection begins.
- Implement a consent management platform that records consent timestamps, versions, and scope for every data subject.
Compliance & monitoring measures
- Schedule regular internal compliance audits against GDPR Articles 6, 7, and 9 to detect unlawful processing before regulators do.
- Train customer-facing and product teams on the distinction between special-category data and standard personal data, including handling requirements.
- Assign clear ownership to a Data Protection Officer (DPO) for ongoing oversight of biometric data processing activities.