GDPR Biometric Data: Croatia Fines Casino €2.59m Over Player Fingerprints

Short answer: on 2 October 2026, Croatia’s Personal Data Protection Agency (AZOP) fined an unnamed gambling operator EUR 2.59 million for unlawfully processing players’ biometric data. The casino collected fingerprints to identify returning players but took four fingerprints instead of the two it described, could not show this was necessary, and relied on bundled, poorly explained consent. It is one of the clearest recent warnings that GDPR biometric data rules apply fully to gambling operators.

What AZOP found

AZOP opened the investigation on its own initiative. According to public reports of the decision, the operator let casino players identify themselves with an identity card, an RFID chip or their fingerprints. The biometric option was meant to speed up identification of returning customers. The regulator found that:

• More data than described. The operator said it collected two fingerprints, but in fact collected four, two from each hand.
• Necessity not shown. The operator did not demonstrate why four fingerprints were needed, especially when other identification methods were available.
• Invalid consent. Biometric consent was recorded for 34,933 players, but the consent bundled several separate purposes together. A similar issue arose with photographs.
• Incomplete information. Registration documents did not properly explain how the data would be used.

Reports indicate infringements of Articles 5, 6, 7, 9, 12 and 13 of the General Data Protection Regulation (GDPR). AZOP has not publicly named the operator, and public reports do not say whether the decision is under appeal.

Why GDPR biometric data rules are so strict

Fingerprints used to identify a person are “special category” data under Article 9 GDPR. Processing them is prohibited unless an exception applies, most often explicit consent. That consent must be freely given, specific, informed and unambiguous, as Article 7 requires. Bundling it with other purposes, or making it a condition of service when alternatives exist, undermines it.

The data minimisation principle in Article 5 also applies: even with valid consent, a controller may collect only what is necessary. Taking four fingerprints when two, or none, would do is exactly the kind of excess regulators look for. Transparency under Articles 12 and 13, the subject of the EDPB’s 2026 coordinated enforcement action, requires players to be told clearly what is collected and why.

A pattern in Croatian gambling enforcement

This is not AZOP’s first action in the sector. In 2023 it fined a sports betting operator EUR 380,000 for collecting copies of customers’ bank cards that were not required by anti-money laundering law. In 2025 it fined a casino EUR 12,000 for failing to appoint a Data Protection Officer (DPO). Together, these cases show a regulator that understands gambling operations and tests whether “we need it for AML or security” is actually true.

5 lessons on biometric data for gambling operators

1. Offer a real alternative. If players can identify with an ID card or chip, biometrics must stay optional and consent must not be pressured.
2. Collect the minimum. Justify the number of fingerprints, the template format and the retention period in writing.
3. Separate consents. Do not combine biometric consent with marketing, photographs or terms and conditions.
4. Run a DPIA first. Large-scale special category processing almost always requires a data protection impact assessment.
5. Align AML and privacy. AML rules justify identification, not every possible data point. Check what your AML law actually requires before relying on it. Our guide to GDPR compliance basics and our article on how regulators decide between a fine and a reprimand explain the wider framework.

If biometric systems are supplied by a vendor, make sure the contract meets Article 28 GDPR. See what a data processing agreement must include.

What a compliant biometric set-up looks like

A defensible approach usually combines several elements. Players are offered biometric identification as one option among others, with no penalty for refusing. Consent is captured on its own screen or form, written in plain language, and can be withdrawn as easily as it was given. Only the minimum biometric template is stored, encrypted and separated from other player data, with a defined deletion date when the player closes their account or stops visiting. Access is limited and logged. The DPIA, the necessity assessment and the vendor contract are kept on file so the operator can show the regulator its reasoning, not just its intentions.

Limits and uncertainty

The full decision is published in Croatian and the operator is not named, so some details come from reliable summaries rather than the decision text itself. The outcome may change if the decision is challenged. This article is general information, not legal advice.

Conclusion

The Croatian case shows that convenience is not a legal basis. Gambling operators can use biometric data, but only with genuine choice, minimal collection, separate and informed consent, and a documented assessment of necessity. Without these, the cost of a faster entry process can run into millions.

Sources

• Digital Policy Alert: AZOP imposes EUR 2.59 million fine on gambling operator over biometric data (2 October 2026)
• MLex: Croatian gambling operator gets EUR 2.6m GDPR fine over players’ fingerprint data
• Croatian Personal Data Protection Agency (AZOP)
• Regulation (EU) 2016/679 (GDPR)