Violations of privacy laws would be resolved after investigations of casinos in three Baltic States
Lithuanian, Latvian and Estonian Data Protection Authorities release findings form investigation of casinos
Vilnius, Lithuania and Riga, Latvia and Tallinn, Estonia, March 20, 2014 - The Personal Data Supervision Authorities of the Baltic countries (hereafter – the Baltic DPAs) for the second time carried out a joint investigation regarding the personal data processing and protection within the gambling sector. Alltogether 13 casinos of the Baltic countries were inspected within 2013.
It is worth to consider that the national legislation regarding the gambling sets certain requirements regarding personal data processing and protection, including requirement for gaming establishments (casinos) to be equipped with a continuously operating digital video recording system, therefore the lawfulness of the personal data processing was assessed in the light of the corresponding legal act of each Baltic country and with the Personal Data Protection Law.
Key findings and outcome
The main outcome of the joint investigation – there is a need to improve the personal data processing and protection practice in all the casinos inspected, especially regarding information gathered from the data subjects (visitors), personal data processed within the video surveillance (especially regarding the work quality assessment purposes and data subject information regarding the video surveillance).
- It was concluded that the casinos in Lithuania and Latvia were collecting the passport copies from the clients, though the legislation of these countries does not provide for such an obligation.
- In Lithuania and Latvia the issue regarding the personal data within the direct marketing and communication to clients should be reconsidered in order to ensure the conformity with the personal data protection legislation.
- One of the major concerns from the personal data protection perspective is the retention period of the personal data (both regarding video surveillance and client’s register) and this issue would be discussed with the corresponding supervision authorities of the gambling sector in each country in order to ensure a harmonised approach to the data processing and protection within this sector.
Each DPA will or already has provided recommendations for the casinos in order to improve the shortcomings in the field of personal data processing and protection.
It is foreseen to continue the cooperation by carrying out a joint inspection in the field of personal data processing and protection thus in 2014 a joint investigation in SPAs that provide medical treatment will be carried out in all three Baltic countries.
Latvian Data State Inspectorate
Lithuanian State Data Protection Inspectorate
Estonian Data Protection Inspectorate