BLACK LIST AND DATA PROTECTION
By Mugurel Olariu, RPD protectie date
The special regulations in the field of gambling – EO no.77 / 2009 and GD no.111 / 2016, provide in several articles, certain obligations of the organizers of gambling, both from the land base and from the on-line environment, and specific to the latter is the Black List.
For terminological clarification, we specify that the Black List refers, in the strict sense, to sites, gaming platforms or gambling applications, which are not declared to the National Office for Gambling (hereinafter referred to as ONJN) and the amounts due were paid, according to art.15 paragraph (4) letter c) and art.17 of EO no.77 / 2009, respectively of art.141 of GD no.111 / 2016.
This Black List is not subject to the provisions of the GDPR, because it refers to gambling sites, platforms and applications, which are not carried out according to the authorization, licensing and taxation regime in Romania. Consequently, as no personal data are processed through them, ONJN, as the central structure specialized in the matter, exercises the task of establishing the Black List, respectively of introducing and removing their name from the list.
Also, by GD no. 111/2016 are regulated two ways of working, but depending on the party that initiates the approach, ie the participant in the game/player or the organizer of the casino. Thus, the two processing methods refer specifically to self-exclusion – at the initiative of the participant and the declaration as undesirable of the person – at the initiative of the casino, as a gambling organizer.
The self-exclusion can be temporary, permanent or the interruption of the access for a predetermined period of maximum 7 days, according to art.132 of GD no.111 / 2016. It should be noted that self-exclusion, as a unilateral act of will of the player, must not be motivated. We also specify that self-exclusion can operate only at the level of the operator to which it was requested, it is not opposable to other operators, as gambling organizers. In this way, we can also meet with the situation that the participant returns to the request for self-exclusion and the operator will take the necessary measures to make the appropriate entries in the List of self-excluded players.
The declaration as undesirable of the person is made by internal decision of the casino, which is communicated to the ONJN, together with the reasons underlying this measure. This measure to prohibit access to the casino must be motivated by inappropriate behavior that impairs the proper conduct of business, according to Article 50 of GD no. 111/2016. Thus, the reasons for taking that decision are related to the conduct of the person against whom this restrictive measure is taken, and that conduct must be such as to prevent the smooth running of the operator’s business. In order to adapt to the GDPR field, it results that this type of processing takes into account a compound legal basis – both legal obligation and legitimate interest of the operator, so including performing a comparative test in five stages.
We mention that, compared to the Black List – which targets sites, platforms or applications, both self-exclusion and the declaration as undesirable of the person, are steps that involve the processing of personal data, as long as these processing concerns a specific individual, identified. Thus, the gambling operators have in these situations, the obligations provided by the GDPR, regarding these processing of personal data – information, consent, storage, etc.
At the same time, the operators must prove an active behavior regarding the data bases referring to self-excluded and undesirable persons, according to art.145 of GD no.111 / 2016. In this regard, the first obligation is to transmit the database to the public interest foundation, which will manage it according to its own purposes, and the second concerns the free provision of ONJN, police and licensed operators, but subject to compliance with the legal provisions in force, including the GDPR.
Finally, we point out that there is a legislative proposal for the amendment of EO no. 77/2009, which aims at extending the obligations of gambling operators regarding the declaration of undesirable persons, for all types of gambling. However, until the adoption of this proposal, the special rules in force grant this possibility only to a qualified category of gambling operators, namely casinos.
———————————————————————————
1. https://senat.ro/legis/pdf/2020/20b535FG.PDF
