Gambling hall operator – Court Ruling (Germany, 2020)

The plaintiff, an interest grouping for gambling machines production companies, had noticed that on several occasions the defendant, a gambling hall operator, had not verified the identity of players at their entries. As a result, there was no alignement with the Hessian system OASIS listing of all banned players. Among other things, the defendant argued that it would be contrary to the GDPR to verify the identity of all players, especially if they turned out not to be banned, making the processing of data unlawful. Is it contrary to the provisions of the GDPR for gambling hall operators to verify the identity of non-banned players at their entries? The Higher Regional Court of Frankfurt points out that, according to Article 6(1)(e) GDPR, a data processing is to be considered lawful if it is necessary for the performance of a task carried out in the public interest. As articles 6(2) and 6(3) GDPR allow the Member States to introduce more specific provisions to adapt the application of the rules of Article 6(1)(e) GDPR, the Hessian legislator made use of this possibility through § 6(1) of the Hessian gambling law. As such, the processing of data for protection of players and combating gambling addiction is lawful because it is carried out in public interest. Beyond that, a gambling hall operator can and even must verify all identities at their entries, not only those of the banned players, in order to fulfill the primary purpose of the data processing.