Nicole Kardell on Keeping iGaming Clients Nimble Amidst Ever-Evolving Privacy Regulations 

By: Ifrah Law

For iGaming companies, protecting customer privacy is paramount: Nicole Kardell acts as their guardian against federal, state and civil actions that could damage their reputations and profitability. Nicole performs on the leading edge of privacy law, helping to keep Ifrah’s clients in compliance with U.S. and international regulations governing the handling of customers’ confidential information. A certified privacy professional with expertise in European privacy law (CIPP/E), Nicole works with iGaming operators and other industry participants to navigate the complex challenge of keeping players safe.

360-Degree Risks: Keeping iGaming Companies On Top of the Privacy Game 
Nicole works with a number of iGaming operators to help them maintain privacy compliance for their platforms. They rely on her for clear guidance on public-facing privacy statements, internal privacy policies, data protection agreements, data retention practices, data breach response procedures and employee privacy training.

iGaming operators are rapidly integrating AI into their systems to help support responsible gaming, age verification and marketing controls. Meanwhile, bad actors are intent on using AI to exploit these systems. Nicole has undertaken an AI certification process to deepen her facility with this powerful technology, both to strengthen clients’ privacy protection efforts and raise awareness of arising perils from threats both foreign and domestic.

“There’s been an ongoing trend towards creation of more privacy laws, and lately we’ve seen greater focus on AI and how it’s used by iGaming companies, particularly in relation to protecting children.”

Young Guns: Advising New Companies About Too-Quick Broadcasting of Privacy Policies
One of Nicole’s watch-outs for new iGaming entrants is hit the pause button before releasing public-facing privacy policies. Many such companies draft privacy policies in a well-intentioned effort to show their commitment to transparency. However, they might not need such policies at their stage of development – and could be legally bound by whatever they put out on the web.

Nicole works with new companies to determine what steps, if any, they need to take to establish and release privacy policies for their businesses. States have a broad range of revenue thresholds and other rules that may require – or exempt – a company from meeting certain requirements. With Nicole’s guidance they can invest in the right privacy protections and infrastructure at the right times in their business lifecycles.

“Currently, 23 states have privacy laws for iGaming companies, and the revenue thresholds for compliance range greatly. So, we’ve created a state-by-state privacy law tracker, which we frequently update, to guide clients through requirements impacting their business and customers.”

MVP HIGHLIGHT REEL

Hot Potato: Data Company Rightly Returns Data Breach Reporting Duties to iGaming Operators

For Ifrah’s client, a data storage company that serves iGaming operators, the news was not good: a significant data breach had been detected. The company quickly took steps to protect against further exposure of players’ personal information, including such data as Social Security and driver’s license numbers. Adding to the pressure, iGaming operators were pushing the company to issue notices about the breach. Before initiating such a daunting process, the company called Ifrah.

Drawing on her knowledge of data privacy law, Nicole Kardell knew that the burden of notifications fell to operators, not data storage providers. But, she researched the laws of all 50 states to confirm that it is the data controllers – those who own, manage or license the data – that are responsible for all reporting requirements related to breaches, and not third parties.

Nicole understood that her client needed to break this unwelcome news to the operators in a way that would help preserve relationships. So she and her team prepared a 50-state chart for the client, which clearly showed the data-owning entities’ responsibilities, notification requirements and legal considerations. Nicole’s client shared the chart with operators, with Nicole joining in calls with operators who were preparing their notifications.

Policy Boomerang: iGaming Companies Targeted by Plaintiffs’ Firms Using California’s Disclosure Law

iGaming companies take proactive steps to demonstrate their commitment to preserving player privacy. They often issue public-facing data-protection policies that detail their rigorous processes. Such policies are ubiquitous, but states all have slightly different rules, and certain states can make compliance particularly daunting.

Case in point: California, a state renowned for consumer-protection laws that stretch beyond federal rules, often in surprising ways. For example, the state’s “Shine the Light” law lets residents initiate a once-a-year request to businesses for a list of personal information that’s been shared with third parties for direct marketing purposes over the previous year. This seems fairly innocuous, except plaintiff’s law firms lately are leveraging the law to probe iGaming companies, evidently to look for flaws in their privacy practices that might fuel class action lawsuits.

A number of Ifrah clients have received data requests from such law firms, posing questions about company data, data protection and practices, and related information. Fortunately, Nicole had previously advised many such clients regarding their policies and communications. She helps them prepare a robust response that meets the intent of the law in a straightforward way.

The result is that, at this point, these data requests have been met expeditiously – and no subsequent steps from plaintiff’s firms have been initiated.