French Regulator Updates GDPR Guide for Gambling Operators
France’s gambling regulator, the Autorité Nationale des Jeux (ANJ), working with the CNIL, has released an updated guide to help operators align their data practices with the General Data Protection Regulation (GDPR).
The document is not prescriptive but aims to clarify existing rules and provide practical recommendations for casinos, online betting platforms, and exclusive rights holders such as FDJ and PMU.
It highlights the unique legal environment of gambling, where operators must balance commercial activity with state policy goals like preventing excessive play, protecting minors, and fighting fraud and money laundering.
GDPR principles designed for gambling operators
The updated guide begins with a reminder of GDPR’s general principles, including the definition of personal data and what counts as “processing.”
It explains that even simple actions like consulting a file or keeping paper records fall under GDPR. Sensitive data, such as health information or biometric identifiers, require special safeguards, and operators must only collect them when justified by public interest, such as preventing pathological gambling.
The ANJ stresses that every data collection must have a clear and legitimate purpose. For example, files tracking players with excessive gambling habits cannot later be reused for marketing offers.
Operators are identified as the “responsible party” for data processing, while service providers like payment firms or IT hosts act as subcontractors with their own obligations. Contracts must spell out responsibilities, from security measures to breach notifications.
Read more Every Premier League Darts play-off night 9-darter: From Luke Littler to Phil Taylor
Compliance starts with practical steps: appointing a Data Protection Officer (DPO), mapping all data flows, and publishing a transparent privacy policy. Operators are urged to set up internal procedures for handling consent, security incidents, and player rights requests. In cases where risks are high, such as profiling players or monitoring for money laundering, an impact assessment must be carried out.
Anti‑money laundering and counter‑terrorism financing obligations
A major section of the guide focuses on how GDPR interacts with anti‑money laundering (AML) and counter‑terrorism financing (CTF) requirements.
The guide explains that monitoring suspicious activity, identifying unusual payment patterns, and flagging high‑risk customers all involve processing personal data at scale. Operators must ensure that these processes are lawful, transparent, and secure.
The ANJ and CNIL highlight that impact assessments are mandatory when data is used to detect or prevent money laundering, because the risks to individual rights are significant. Operators are expected to document how they collect, store, and share information with authorities, and to put in place strong safeguards against misuse.
Contracts with service providers must also spell out responsibilities, ensuring that payment processors, IT hosts, and identity‑verification firms meet GDPR standards.
Comments