Online Gambling Data Protection & Privacy

[P.V.]

Interesting article, online gambling, data protection and privacy laws.

Simon Davies, founder of Privacy International, has blasted the online gaming industry for inadequately protecting gamblers' privacy and failing to adhere to basic principles of data protection.

It's a 2 page article:

You do not have permission to view link Log in or register now.

And his blog article:

You do not have permission to view link Log in or register now.

 

[maxd]

Apparently Davies main thesis is that the casinos are putting player data at risk by ignoring their responsibilities to protect, and more specifically destroy, that data. I think he is seriously missing the point. IMO Data Protection is one of the most abused pieces of legislation in the business, and not because of what Mr. Davies apparently has to say about it.

From where I see things Data Protection is seriously abused by many casinos as an excuse for not talking about player issue(s). It's soooooo easy to say "can't talk about it, Data Protection" and hide behind that as a reason to say nothing about the most flagrant anti-player activities in the business. And this is done by huge casino groups, some of the largest and most powerful companies in the online gaming sector. They are not all cheating players but many are and in those cases the stuff that gets swept under the carpet under the guise of "Data Protection" would curl your hair: imagine the worst and then double it, now you're getting close. When those same casinos are confronted with this they will say "sorry, our lawyers advise blah blah blah, Data Protection blah blah blah". And there's the real reason why casinos typically trot out Data Protection, to shield themselves from scrutiny. They use Data Protection as a free pass to screw players over, not protect them.

Data Protection is a well-meaning legislation I have no doubt but it assumes that casinos will use it to protect player's interests. Clearly that is like saying the lion will protect the lamb's interests. Sure they will, just hand over your lambs please. And if the lamb goes missing? "Can't talk about it, Data Protection!"

The moment a piece of legislation assumes that a corporation will protect customer interests because they're just good people and want to do the right thing is the moment that legislation turns into a weapon against the very customers it is supposed to protect. It can't work because corporations will always protect their own interests first, often just the (monetary) interests of their executives. The customer is way down the food chain and is usually labelled "dinner". Things like Data Protection only end up entrenching that reality, good intentions notwithstanding.

The truth is that it is almost never necessary to get anywhere close to Data Protection issues when discussing a player's case. And if it is absolutely necessary then the player can take steps to allow the casino to proceed. Of course the same casinos that say "can't talk, Data Protection" are the same one's who'll use every other excuse in the book to avoid discussing those issues, such as "player's wishes are not relevant" and so forth. It's major league BS IMO: the real problem with Data Protection is casinos abusing it to hide from public view, not player privacy violations.

I don't disagree with Simon Davies insofar as he goes but IMO his issue is rather small potatoes compared to the fact that Data Protection is so deeply flawed that it is guaranteed to harm the very people it is tries to protect. The legislation simply cannot work as currently presented and will not work until there are teeth in it that can be used to bite casinos that abuse it. How is this to be accomplished? Big question! And much bigger than Davies' claim that player data is not being properly disposed of.

 

[jetset]

This article represents the pretty inflammatory opinion of its author, but it is getting wide coverage in computer journals due to the sensitivity of the subject and the provocative nature of the op-ed piece.

Nevertheless he does name some surprising names and that needs attention by the operators concerned - it may well be a screwed up interpretation of company policy by junior employees, but it reflects badly and should be addressed.

 

[P.V.]

Apparently Davies main thesis is that the casinos are putting player data at risk by ignoring their responsibilities to protect, and more specifically destroy, that data. I think he is seriously missing the point. IMO Data Protection is one of the most abused pieces of legislation in the business, and not because of what Mr. Davies apparently has to say about it.

From where I see things Data Protection is seriously abused by many casinos as an excuse for not talking about player issue(s). It's soooooo easy to say "can't talk about it, Data Protection" and hide behind that as a reason to say nothing about the most flagrant anti-player activities in the business. And this is done by huge casino groups, some of the largest and most powerful companies in the online gaming sector. They are not all cheating players but many are and in those cases the stuff that gets swept under the carpet under the guise of "Data Protection" would curl your hair: imagine the worst and then double it, now you're getting close. When those same casinos are confronted with this they will say "sorry, our lawyers advise blah blah blah, Data Protection blah blah blah". And there's the real reason why casinos typically trot out Data Protection, to shield themselves from scrutiny. They use Data Protection as a free pass to screw players over, not protect them.

Data Protection is a well-meaning legislation I have no doubt but it assumes that casinos will use it to protect player's interests. Clearly that is like saying the lion will protect the lamb's interests. Sure they will, just hand over your lambs please. And if the lamb goes missing? "Can't talk about it, Data Protection!"

The moment a piece of legislation assumes that a corporation will protect customer interests because they're just good people and want to do the right thing is the moment that legislation turns into a weapon against the very customers it is supposed to protect. It can't work because corporations will always protect their own interests first, often just the (monetary) interests of their executives. The customer is way down the food chain and is usually labelled "dinner". Things like Data Protection only end up entrenching that reality, good intentions notwithstanding.

The truth is that it is almost never necessary to get anywhere close to Data Protection issues when discussing a player's case. And if it is absolutely necessary then the player can take steps to allow the casino to proceed. Of course the same casinos that say "can't talk, Data Protection" are the same one's who'll use every other excuse in the book to avoid discussing those issues, such as "player's wishes are not relevant" and so forth. It's major league BS IMO: the real problem with Data Protection is casinos abusing it to hide from public view, not player privacy violations.

I don't disagree with Simon Davies insofar as he goes but IMO his issue is rather small potatoes compared to the fact that Data Protection is so deeply flawed that it is guaranteed to harm the very people it is tries to protect. The legislation simply cannot work as currently presented and will not work until there are teeth in it that can be used to bite casinos that abuse it. How is this to be accomplished? Big question! And much bigger than Davies' claim that player data is not being properly disposed of.

Your situation is unique being a PAB manager therefore needing access to everything available during the dispute process. I totally understand how this could bog you down or even halt your efforts.

IMO a player requesting a PAB when personal data is involved should provide you with their details upfront then you're not asking the casino, you already have it.

This way you tell them what you have vs. asking them and being rejected.

Davies investigation seems rational, with a valid complaint. He was trying to close his accounts and remove his data from online casino servers.

 

[maxd]

Your situation is unique being a PAB manager therefore needing access to everything available during the dispute process.

Actually that's typically _not_ the case at all, as I mentioned earlier. Most PABs require pretty basic information, almost never stuff that encroaches on what's covered by Data Protection. Again, it's really not the data that is the issue, it's the desire of casinos to avoid scrutiny and using Data Protection as an excuse to say nothing.

As to the player data I can't see how there's any alternative to getting that from the casinos. We need to work from the same info they have or the discussion goes nowhere. Anything the player supplies is typically suspect and inadmissible as far as the casino people are concerned.

Davies investigation seems rational, with a valid complaint.

Agreed, as I said, I have no problem with his issue other than the fact that it is seriously overshadowed by (a) the fundamentally flawed nature of Data Protection as it stands and (b) the seemingly irresistible urge many casinos have to abuse Data Protection for their own purposes. The risk of compromised player data is collateral damage.

 

[cheetahwind]

Well I can see his points, and I can also see the operators points too.
Like for example, not wanting to delete your information right away.
Lets say example, I want to close my account at Casinomeister Casino (purely an example), I get partly why they wouldn't want to delete my information totally right away. Mainly because I could turn around a few months later, still sour for whatever reason I decided to close my account. Then try to take my money back. Well because they deleted my information, they no longer have any idea on who, what, where, when, and why is trying to take there money back. So they would need this information on file, to put into further notes, to possibly add to a blacklist on who this person is.
Yet I guess the other part, other than purely for accounting purposes. I still can't understand why like a year later, assuming that you've done nothing naughty. That you couldn't at least request to have your credit cards, bill/bank statement, voided checks, pieces of ID that was required, and possibly any forms you had to sign. Destroyed. That way at least, the only information they still may have about your is nothing more than you couldn't find by doing a simple search online about yourself. Like name, address, city, state/providence, and postal code.
I get what he's saying, and I also get what the operators are saying, but I would think there could be some happy median about the situation.