France’s CNIL and ANJ Join Forces to Update Data Protection Guidelines

These recommendations, developed in collaboration with CNIL, France’s agency for IT and civil liberties, are intended for all licensed operators in the country, including both online and physical bookmakers and casinos, as well as legacy monopolists like PMU and FDJ.

Key Details from the Document

The new instructions are positioned more as guidance than strict rules. However, the provisions outlined have been in place since the GDPR was enacted in 2018. The document highlights the scale and sensitivity of the data involved.

The authority advised businesses to handle the following information carefully:

• ID inscriptions;
• promotional preferences;
• indicators of responsible gaming;
• betting and transaction histories;
• payment and contact details, etc.

The regulatory body also recommended that operators appoint a dedicated officer to safeguard these records and emphasised the importance of mapping all activities related to data collection, management, and storage. Companies that develop clear privacy policies, document procedures, and conduct impact assessments when necessary will substantially enhance their reputation.

Focus Areas Spotlighted in the Guidelines

The revised document also covers nuances of marketing strategies. Business owners must obtain client permission for any gambling-related commercial activity across all communication channels, including SMS, e-mails, posts, phone/automated calls, etc.

Entrepreneurs should ensure that consumers provide explicit consent for actions beyond merely accepting general terms. Specifically, approval is required for sharing user information with 3rd-party commercial organisations, which must be clearly stated.

Let us review other provisions outlined in the paper:

1. Cookies and monitoring technologies. Typically, customer consent should be obtained before storing or accessing their device data. However, exceptions include essential elements such as anonymous visitor measures or authentication services. Operators must also ensure that opting to accept or decline cookies is equally straightforward.
2. Responsible gambling. When the system identifies signs of problematic behaviour, it can start processing health-related data to assess the risk of gaming addiction. AI may conduct customer profiling, but human employees must review and apply any restrictions. It is also necessary to inform clients about classification methods, parameters, and consequences.
3. AML and CTF. Entrepreneurs can collect ID, payment, and transaction details. They also may inquire about fund origins if alert systems justify it. Concurrently, CNIL’s representatives emphasise that indiscriminate requests for documentation, such as bank statements or card duplicates, are considered disproportionate.

As for data retention, gaming account information is generally stored for 6 years after closure, and AML details can be maintained for up to 5 years. The document highlights that certain user rights, like erasures, objections, or portabilities, are not applicable under AML-mandated measures.

Stay informed about the latest industry news and innovations with Gaminator’s experts. With our professional support, you can establish a legal gambling project and operate securely, transparently, and responsibly while generating solid profits.