Feeds

Gambling companies must be extra careful with personal data

Protect punters' info while palming their cash

Top 5 reasons to deploy VMware with Tegile

If you do not react quickly, if you do not share information with customers and if you do not offer appropriate compensation, you will suffer a major backlash. People understand that mistakes can be made. If you try to hide them or try to avoid responsibility, that is when you will find the public turning against you.

A civil case being brought against Sony in Canada has reportedly argued that the company's failure to notify customers and regulators about the breach exacerbated its non-compliance. As well as considering their regulatory obligations, companies should check their own terms and conditions to see what they have promised they will do in this situation.

If your operation covers many countries, apply the standards of the most rigorous regime. Customers will not welcome seeing other people treated better because of where they live. Again, the biggest risk to your firm is reputational, not regulatory. In a fast-moving competitive market, there are plenty of other operators waiting to pick up disenchanted customers in the wake of a security breach.

That said, the regulators most certainly matter. Gambling is in a different position to most industries because there is an obligation to report any serious data security breach.

The Gambling Commission's Information Security Code of Practice requires licensed operators regulated in Great Britain to notify the Gambling Commission of any major breach of information security that adversely affects the confidentiality of customer data or prevents customers accessing their accounts for a substantial period.

The DPA does not require businesses generally to notify the ICO of a breach, but significant breaches should be notified: it is far better if an organisation is able to tell the ICO its side of the story rather than the ICO finding out from the press or disgruntled customers.

A review of data protection legislation is now underway at European Union level and a mandatory requirement to notify information security regulators in the wake of high profile security breaches is one of the options being considered.

A gambling operator will have many concerns, and many systems to oversee. Protecting a database of customer details might not seem to be deserving of a place at the top of a priority list, but the consequences of a breach can be truly dire. Just ask Sony.

Copyright © 2011, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Internet Security Threat Report 2014

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.