Biometric Consent Cannot Cure Excessive Data Collection: Lessons for U.S. Companies from a €2.59 Million GDPR Fine

The Croatian data protection authority (AZOP) imposed a €2.59 million fine on a casino company for collecting fingerprints and photographs in violation of the GDPR. The authority found that the company violated the principle of data minimization by collecting four fingerprints without demonstrating that doing so was necessary. It also found that the company’s consent was invalid because multiple processing purposes were bundled together.