Monitoring Problem Gamblers Raises Privacy Issues

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Nora Macaluso and Marcus Hoy

Dec. 14 — Ubiquitous monitoring of legal gambling operations for signs of fraud and other criminal activity is well accepted as a business necessity and not an invasion of privacy but proactively monitoring individual gamblers through big data analytics ostensibly for their own good—even with their implied consent. Not so much.

If a recent ruling by Sweden's data protection authority gains traction with privacy regulators in other countries, it would not only crimp the effectiveness of a popular way of fighting gambling addiction but also might put a damper on investment, some who are watching the issue tell Bloomberg BNA.

The Swedish Data Inspection Board ruled that state-owned gambling company AB Svenska Spel—“Swedish Games”—Playscan software used to monitor customers' betting habits for evidence of compulsive behavior, could be in violation of Swedish and European Union privacy law (203 Privacy Law Watch 203, 10/21/15)(14 PVLR 1941, 10/26/15).

The Swedish DPA is “known as a fairly aggressive regulator,” Thomas F. Zych, a partner at Thompson Hine LLP in Cleveland, chair of the firm's emerging technologies practice and head of its privacy and cybersecurity team, said. “As far as I know, they're the first one that's taken on the gaming analytics, but it's not inconsistent with what other European countries are doing in other settings.”

In general, data protection authorities have “a very narrow focus,” Zych said. “When all you have is a hammer, everything looks like a nail,” he said.

For U.S. companies that operate globally, “when you're working on a product offering, a service—even in this case a social good—you have to ask yourself in this enforcement environment whether it's wise to go forward or forgo these socially valuable efforts,” Zych said. “There may also be a reason—and we're always loath as practitioners to bring to regulators' attention things that they're not paying attention to—there are circumstances where we may want to go to the authorities first,” he said.

“You have to have a feeling for regulators, have an on-the-ground sense of what this DPA is going to do,” and it may be worth investigating before investing, Zych said.

Setback for Problem Gamblers?

“We think it's a setback," Keith Whyte, executive director of the National Council on Problem Gambling, said of the Swedish ruling. The U.S.-based council's stated goal is to ”lead state and national stakeholders in the development of comprehensive policy and programs for all those affected by problem gambling.”

"We believe being able to analyze player behavior to help prevent gambling addiction is just one of the more exciting opportunities in the gaming industry right now, and it's been shown to be very helpful," he said.

“We're watching to see whether this Swedish ruling has a chilling effect on other behavior-tracking issues,” Whyte said. "We're concerned that someone who has a gambling problem who has signed an exclusion notice" or undertaken some other form of self-exclusion will see that information become confidential, he said.

“There has not been a single incident we're aware of where a problem gambler has alleged a gaming regulator has inappropriately released that information,” he said.

Clive Hawkswood, chief executive of the London-based Remote Gambling Association, said he hopes the Swedish ruling won't deter online gambling companies from developing systems that allow problem gamblers to be detected. “We are sure such measures can be put in place without breaching data protection laws, and that they will be of increasing use in minimizing gambling-related harm,” he said.

Consent at Issue

There may be some misunderstanding about the scope of the ruling, Henrik Bergström, a partner at Bird & Bird in Stockholm, said. “There is a general misconception as to the impact of this ruling and what it actually addresses,” Bergstrom said.

The ruling “is not specific to the gaming industry, since it only addresses the manner in which Svenska Spel collects sensitive personal data from the gambler and how this information is being processed in relation to the monitoring and prevention of excessive gaming and gaming addiction,” he said. “It does not in any way rule on legitimacy of monitoring programs as such.”

The ruling criticized Svenska Spel's use of “implied consent” to the processing of personal data, rather than “informed, unambiguous and explicit consent,” and for collecting personal data to be used for research, the purposes of which “are not sufficiently clearly defined or specified,” he said.

The case is “about collecting consent, rather than how and if you can use monitoring programs,” Bergström said. “In this case, this means that you would need a consent to the processing of the customer's personal data that is voluntary, specific, unambiguous and informed.”

Regulators Watching

The U.K. Information Commissioner's Office is following the Swedish development and is aware of the “potentially intrusive nature” of online behavioral monitoring, Anya Burgess, spokeswoman for the ICO said. “In a situation like this, we would expect some form of consent mechanism to be in place,” she said.

“Either a clear notification before you start gambling, or a clear pop-up-type notice. It's a matter for the service provider to decide whether those declining to be monitored should be able to continue to use the service,” she said.

Privacy issues haven't cropped up in Asia, “given the very Wild West nature of gaming in the major Asian centers,”

Thomas F. Zych, Partner,
Thompson Hine LLP, Cleveland

Norske Tips, Norway's state gambling body, requires gamblers to give their consent to addiction monitoring by approving general terms and conditions before entering a website, Kim Ellertsen, legal director at Norway's Data Protection Agency, said. There's no opportunity for customers to opt out of monitoring while continuing to use the site, she said.

Effects in U.S., Asia?

In the U.S., “it's a very regulated business. There are gaming commissions” in each state; they're obligated as part of their licensing to combat problem gambling,” Zych said.

“The gaming industry has been very good at analytics for a very long time,” he said. “In a casino, they keep track of everybody. They know what you drink; they know where you sit. To some extent they may have a target on their back,” he said, yet such tracking ability is “key to the business.”

Privacy issues haven't cropped up in Asia, “given the very Wild West nature of gaming in the major Asian centers,” Zych said. In some Asian countries, “the government's the one looking at you, not private industry,” he said.

To contact the reporters on this story: Nora Macaluso in Detorit at and Marcus Hoy in Copenhagen at

To contact the editor responsible for this story: Donald G. Aplin at

Request Bloomberg Law: Privacy & Data Security