GDPR learning for
the iGaming arena.

You’re a Privacy Lawyer at LeoVegas – what’s a typical day in your work-life like?

Broadly speaking I like to group my work into 3 categories; day-to-day tasks, projects, and general compliance work. To give a bit of context, choosing to specialise in data protection requires one to move out of their comfort zone whilst learning and adopting skills from other fields, such as the auditing and information security fields. For example, even though one aspect of my work does consist of activities that are typically associated with lawyers such as negotiating contracts and giving legal advice, the bulk of my work actually consists of carrying out audits, risk assessments, data mapping initiatives, and other long-term projects. In the context of ‘achieving compliance’, in my experience, there is often a huge misconception that being ‘GDPR compliant’ is akin to acquiring a certificate. In truth, the privacy team and I never stop working in ensuring that our company is and, more importantly, remains compliant with data protection laws. This is easier said than done and often requires that we are involved in long complex projects from start to finish which requires knowledge and understanding in other complex fields such as AML, payments, risk and fraud, and a keen understanding in technology.

What motivated you to enrol for GDPR Ready Professional bootcamp?

The IAPP’s certification is one of the most recognisable and prestigious certificates that one can obtain in the field. In my opinion, obtaining a certificate is a must if someone wants to specialise in this niche area, especially since the largest companies around the world outrightly highlight that the CIPP/E and CIPM certificates are requirements to land the job. The exams are also considered to be notoriously difficult to pass. The GDPR Ready Professional course gave me all the tools that I needed in order to make studying and passing the exam much easier. The course honestly made the exam less daunting to pursue!

How has GDPR affected the iGaming arena?

One must always keep in mind that first-and-foremost the right to privacy is a fundamental human right. The GDPR is one ‘tool’ with which that right is being protected by the legislator. This places a huge responsibility on companies that have large client bases and process large volumes of data, such as iGaming companies since the potential fines are so large. The GDPR has also added an extra layer of complexity which often ‘spills over’ to other departments, such as AML and responsible gambling, where the privacy team often occupies a crucial support role in determining whether something is within the parameters of the law or not. With that said, in my humble opinion, the biggest impact that the GDPR has had was in relation to the customer’s relationship with the company. Going back to my previous point, how can present and potential customers place their trust in your company when they know that you cannot safeguard their data? Data breaches and large fines impact the customer’s experience with your product, and reputation is key in any business. This is further exemplified by the fact that new laws, such as the new ePrivacy regulation which is currently debated at EU level and judgments, such as Planet49 and Schrems II, are drastically shaking things up which requires a business to remain constantly abreast of any new developments.

What did you enjoy most about your study experience?

I loved the fact that this was a ‘one-stop-shop’ experience; ICE Malta gave me all the tools I needed to help me obtain the certification through an exam. Furthermore, the tutor is extremely helpful, experienced, and also gives a unique and enthusiastic ‘twist’ to the way the subject is presented. Finally, the examination environment caters to all your needs whilst ensuring that you remain 100% focused on acing your exam. This also holds true under the current restrictive measures introduced due to the global pandemic, when sitting for my exam I felt that I was in a safe environment and yet had all the resources of the centre available to me.

What study techniques can you share with prospective students?

Personally, flashcards have always worked wonders for me. Moreover, in the context of the IAPP exams, I also recommend that one delves into guidance by the European Data Protection Board (formerly the ‘Working Party 29’) in order to give you the final ‘polish’ that you need to pass the exam, and also to look at the recitals of the GDPR in order to get a comprehensive understanding of what the law says.

What’s your next learning goal?

My experience working in this line has thought me that in order to be a specialist in your field you must also have an understanding of other fields that overlap that specific line that you are specialising in. My next aim is to get a better understanding of concepts such as AML and Fraud which have often overlapped in my day-to-day work. I would also be interested in going for the CIPP/US exam and have an excuse to sit for the exam at the ICE Malta premises once again.