Database on self-excluded and undesirable persons – practical challenges brought by the new legislation from a regulatory and personal data protection perspective f50h

  532x5z

by Cosmina Maria Simion, Managing Partner and Petruș Partene, Senior Associate

The legislation applicable to the field of gambling in Romania has undergone significant changes with the entry into force on October 6, 2023 of the Government Emergency Ordinance no. 82/2023 for amending and supplementing Government Emergency Ordinance no. 77/2009 on the organization and operation of games of chance, as well as for amending Government Emergency Ordinance no. 20/2013 on the establishment, organizing and functioning of the National Office for Gambling and for amending and supplementing Government Emergency Ordinance nr. 77/2009 (GEO 82/2023). These changes include legal provisions that lay the foundations for the creation, at the level of the National Office for Gambling (“ONJN“), of the database on self-excluded and undesirable persons.

Thus, Article 15¹ of the Government Emergency Ordinance no. 77/2009 on the organization and operation of games of chance (GEO 77/2009) was amended in order to transfer the obligation to draw up, manage and constantly update a database on self-excluded and undesirable persons from the operators to ONJN. This centralized database shall ensure real time access to all gambling operators.

How will this database be set up? According to the new amendments to GEO 77/2009, individuals who wish to self-exclude will be able to submit such requests to the gambling operator or directly to the ONJN. If the application is submitted to the gambling operator, the latter is obliged to forward the application to the ONJN within two working days from the date of registration. With regard to undesirable persons, the operators of games of chance are obliged to send the lists of persons who have been declared undesirable by the internal decisions of the organisers of games of chance (together with the reasons for this measure) within five working days from the date of drawing up or amending these lists.

While from the perspective of self-excluded persons things seem relatively clear (since the legislation does not offer the possibility to self-exclude in relation to only one operator), the effect of a person being declared undesirable by a gambling operator still remains unclear. If the declaration of undesirability by an operator makes it impossible for the player to access the services offered by the other operators, standardizing the criteria to be taken into when declaring a player undesirable is needed. This may prove necessary in order to avoid potential abuses as well as situations in which the same actions of a player are considered by one operator to be such as to lead to the player being declared undesirable, while another operator does not consider them problematic.

self-excluded

From another perspective, it is important to mention that, in line with the provisions of Art. 15¹ para. (3) of GEO 77/2009, the obligations placed on gambling operators must be carried out in compliance with the legal framework applicable to the processing of personal data. In this regard, we emphasize several aspects that must be taken into by operators in relation to the processing of personal data belonging to self-excluded and undesirable persons.

In accordance with the applicable legislation (GDPR), any data processing activity must have a legal basis and in the case at hand the legal basis lies in the explicit legal obligation imposed to the operators by Art. 15¹ of GEO 77/2009.

Even though the data processing will be performed on the basis of a legal provision, it is still necessary to inform players about these data processing operations. Thus, players must be informed, in line with the information standard required by the GDPR about which data is going to be processed, that this data is processed for the purpose of compiling the database at the level of the ONJN and that this data will be further accessible, in line with the legal regime, by other gambling operators. Gambling operators must be able to prove that they have complied with this information obligation and as a result amendments to the privacy policies should be implemented in this sense.

In addition to the above, it remains to be seen whether the operationalisation of the database of self-excluded and undesirable persons will generate other legal and/or practical challenges for operators. In this respect, by the deadline for operationalisation imposed by the legislation, i.e. 31 March 2024, gambling operators may consider creating and documenting a workflow that facilitates the transmission of information to the ONJN in full compliance with the applicable rules on the protection of personal data. In the end, the implementation of this database by 31 March 2024 inherently requires that until this date operators must notify to ONJN the self-exclusion requests and the lists with undesirable players, these notifications obligations being in force since the enactment of GEO 82/2023 on 6 October 2023.

Simion & Baciu