Transparency and accountability
While valuable to operators, collecting personal information is not as straightforward as simply collecting and analyzing player transactions, as doing so may violate the user’s rights under PIPEDA, as well as pose additional privacy, technical, regulatory, and social risks. Organizations must be careful to maintain transparency and accountability by giving users clear notice, obtaining their consent, and implementing internal controls to ensure the organization is honouring its privacy commitments.
Regulatory compliance with respect to transactional data
Online gaming organizations that collect and process credit card transactions must do so in compliance with Payment Card Industry Data Security Standard (PCI DSS) regulations. Those that neglect to do so risk losing the ability to process credit card transactions, rendering them unable to continue to offer online gaming.
Additionally, moving gaming activities online means operating in an already highly regulated industry. In some cases, the requirements of one regulation can directly conflict with another, leaving organizations to sort through complex legal, technological, and operational issues. In short: the collection and use of personal identifiable information must be fair, lawful, and for legitimate business purposes. Security and privacy safeguards must be in place to prevent the loss or unauthorized use of data, and organizations must strive to comply with regulatory requirements without compromising their commitments to customers.In an environment where an individual’s privacy is sacrosanct, lottery and gaming operators will benefit from developing balanced controls that ensure integrity and transparency when dealing with the privacy-related concerns created by online gaming. Specifically, operators can reduce exposure to risk by implementing clear codes of conduct that address the complex social and ethical challenges, and by also implementing programs, tools, resources, and technology that will help them respond to regulatory and compliance requirements, offer enhanced player protection, and improve their online gaming experience.
By proactively dealing with these issues, a lottery operator can more safely and prudently access the significant online markets.
By Lauren Easom (CIPP, CISA) & Louie Velocci (CA-CISA, CISSP, CAA, GCFA, CGEIT) - KPMG