Croatian DPA Fines a Gambling Operator EUR 2.59 Million Over Fingerprint Data

What happened?

The Croatian Personal Data Protection Agency (AZOP) investigated a casino operator on its own initiative and announced on 2 October 2026 that it had imposed an administrative fine of EUR 2,590,000, the total for three breaches. AZOP has not publicly named the operator.

What did the investigation find?

Players at the operator’s casinos could identify themselves with an ID card, an RFID chip, or a fingerprint scan for returning players. The operator told AZOP it collected two fingerprints per player. AZOP’s inspection found it actually collected four, two from each hand, and used them for biometric identification. AZOP recorded biometric consent statements for 34,933 players.

The operator said the extra prints were backups in case skin damage stopped a scan from being read. AZOP rejected a general claim of “backup” prints as proof of necessity: the operator would have had to show why four prints, rather than two plus another identity check, were needed for the stated purpose.

AZOP cited three groups of breaches:

• Unlawful and excessive biometric processing (Articles 5(1)(a) and (c), 6(1), and 9(1) with 9(2)(a)): the data collected went beyond what the stated purpose required, and consent cannot cure that.
• Invalid consent (Article 7 with Article 4(11)): registration screens bundled mandatory identity checks together with optional biometric and photo processing in the same consent request, so players could not choose separately, and the requests were not specific, freely given or clearly presented.
• Poor transparency (Articles 5(1)(a), 12(1) and 13): the documents players saw gave inconsistent and incomplete information about the purposes and legal basis for processing their fingerprints and photos, and some purposes were not disclosed at all.

Why does it matter?

This is a reminder that regulators will check what a company actually does against what it tells customers, not just the wording of a privacy notice. Collecting “a couple of extra” biometric records for convenience, without separately justifying the extra collection, was enough to turn a routine identity check into an unlawful processing finding. Bundling consent for a required process with an optional one is also a recurring theme across GDPR enforcement, not specific to gambling.

What should you do?

If your organisation uses fingerprint, face or other biometric identification for customers or staff, check that what is actually collected matches what is disclosed, that consent for any optional biometric use is separated from consent for the core service, and that your notices say clearly what is collected and why. See our GDPR guide.