Dutch DPA advises on legislative proposal governing online gambling


On-line gambling is still a hot issue in The Netherlands. Following a recent judgment by the Dutch Supreme Court, foreign providers of on-line gambling, who do not have a permit from the Ministry of Justice (the “Ministry”), have to make their on-line services inaccessible to users in The Netherlands. The Ministry is currently drafting new legislation to govern on-line gambling. As this involves the monitoring of on-line gamblers and the processing of their personal data, the Dutch Data Protection Authority (the “Authority”) has been requested to review the legislative proposal.

At present, the proposal merely provides provisional rules on the basis of which it may become possible to grant licences for on-line pilot projects. The aim is to gain experience with the provision of licenced gambling services via the internet as a more controllable alternative to illegal gambling services. The legislative proposal aims to prevent addiction to gambling, protect the consumer and discourage illegality and criminality. With this in mind, the proposal sets out the legal framework for the monitoring of individual gamblers and the processing of their personal data.

This is not the first time that the Authority has been asked to review legislative proposals regarding gambling. In 2002, the Authority was asked to advise the Ministry and reported that it believed that the legislative proposal breached the applicable rules of personal data protection. At the time, the criticism mainly concerned the monitoring of on-line gamblers. The main purposes of monitoring gamblers are to spot excessive gambling, to maintain gambling limits and if necessary, to deny access. The Authority concluded that these purposes might be legitimate, but that the grounds and the implementation of the monitoring had to be sufficiently substantiated. The basis on which the advice was given by the Authority was, therefore, that firstly, it made a recommendation to the Ministry to give that substantiation; secondly, the Ministry should establish whether data concerning health, e.g. gambling addictions, would be processed; thirdly, the Ministry should ensure that the legislative proposal would safeguard personal data that had been processed so that it could not (to the extent possible) be traced back to an individual.

In its present advice to the Ministry, the Authority observes, with some disappointment, that the Ministry has barely (if at all) implemented any of the above mentioned recommendations in its new legislative proposal. As a result, the Authority has included a copy of the earlier advice in its current advice.

The Authority has given several comments regarding the content of the proposal. The Authority asserted that the organisation of and participation in gambling games via the internet involves the processing of personal data of the on-line gamblers, specifically for the fulfilment of the agreement between the licence holder and the gambler. According to the Authority, it is unclear in the current legislative proposal whether the monitoring of individuals involves the processing of ‘special’ or ‘sensitive’ personal data. This question is of key importance because the processing of such data is, in principle, prohibited. The rationale behind the prohibition is that the processing of this data (and the information that can be acquired from it) gives rise to the possibility of its abuse to the detriment of the data subjects in the absence of adequate statutory safeguards.

In the context of on-line gambling in particular, the Authority has noted that there can be a threat of data abuse if a gambler, who is perceived as being addicted to on-line gambling, is discriminated against in other areas, for example when applying for a job, on the basis of this data. This threat is all the more serious because the exchange of data relating to gambling addictions will be required by various licence holders in order to prevent such addictions – one of the key purposes of the gambling proposals.

The Authority assumes that data relating to gambling addiction may indeed qualify as ‘special’ or ‘sensitive’ personal data. In the current situation, an exemption from the prohibition to process such data can only be obtained if the processing is done on the basis of the explicit consent of the data subject or when the law explicitly enables such processing. In any case, without the data subject’s consent, the relevant gambling legislation should provide for adequate privacy safeguards. According to the Authority, such protection should be included in the law and it is not sufficient that such protection is realised by a provision in the gambling licence as currently included in the legislative proposal.

Finally, the Authority has requested that the Ministry keeps the Authority informed about the progress of the current proposal, not least because of the Ministry’s failure to adequately take on board the Authority’s earlier advise on the subject.

The Authority’s advice (in Dutch) can be downloaded from www.cbpweb.nl.