SPECIAL EXCLUSIVE DRAFT RESOLUTION OF THE MECHANISM FOR THE DETECTION OF RISK BEHAVIORS (IV)
NO PRIOR CONSENT: Player Profiling is legal according to the DGOJ
The Data Protection Impact Assessment (DPIA) incorporated into the administrative file of the Draft Resolution addresses and resolves one of the most important legal debates in the digital age: the compatibility between systematic predictive profiling and user privacy.
The report prepared by the Directorate General for the Regulation of Gambling concludes emphatically that the mass processing of transactional records and the continued application of the XGBoost analytical model scrupulously comply with the requirements of the General Data Protection Regulation (GDPR) and Organic Law 3/2018 (LOPDGDD) on the Protection of Personal Data and guarantee of digital rights.
The main pillar of the opinion lies in the establishment of the legal basis that legitimises this automated processing. The DGOJ clarifies that online gambling operators will not need to obtain the prior and express consent of the bettor to submit their history to algorithmic evaluation, as they are fully based on compliance with a direct legal obligation (article 6.1.c of the GDPR) issued within the framework of Law 13/2011 and Royal Decree 176/2023. The safeguarding of public health, the protection of vulnerable groups and the active prevention of pathologies such as gambling addiction operate as purposes of overriding public interest that support the monitoring of transactional patterns without violating the fundamental rights of account holders.
At the same time, the DPIA erects a containment dam based on the principles of proportionality, data minimisation and purpose limitation.The resolution strictly prohibits platforms from feeding the model with sources outside the operator's own transactional environment, preventing the use of external asset information, bank credit scoring or special categories of medical and biometric data. Likewise, the supervisory authority guarantees the full exercise of the rights of access, rectification and deletion, while imposing the obligation to document the complete and auditable traceability of each algorithmic decision, ensuring that in the face of the DGOJ's inspection work the accredited entities can demonstrate the absence of arbitrary or discriminatory biases in the assignment of risk profiles.
