.svg)
Body
Massachusetts regulators have approved a temporary waiver for sports-betting operators to implement newly-approved data privacy rules after all of the state’s operators requested a delayed implementation.
The Massachusetts Gaming Commission approved new data privacy rules governing the use of customer information and setting out a process for patrons to request operators erase their data on August 8.
In a memo, commission staff said that all of the state’s sports wagering operators requested a waiver of some kind, asking for at least 60 days to implement the new regulations rather than allowing the rule to take effect immediately upon publication in the Massachusetts Registry.
During a meeting on Thursday, the commission approved an initial waiver through November 17 and expects to schedule a roundtable discussion with operators to discuss the implementation process.
Several companies said they also intend to seek waivers beyond the initial term to fulfil the requirements, saying that it could take a year or more to fully comply with the new rules.
“Our provisional view is that, given how dramatically the privacy regulations differ from any other privacy law or regulation in the United States, it may take up to two years of extensive and costly work to reach a state of full compliance with them,” DraftKings wrote in its waiver filing.
In its comments, FanDuel called the concept of implementing the regulations ahead of the September 1 effective date “not just a hardship, but rather a technical and operational impossibility.”
“Data privacy regulation is an evolving field,” the company wrote. "In recognition of that fact, when other jurisdictions have implemented broad new data privacy requirements, they have provided lengthy periods (often multiple years) for businesses to develop and implement solutions to comply with the statute and/or regulations."
Among the biggest concerns for operators are provisions that require companies to only use personally identifiable information “as necessary” to operate a sports wagering platform, and require opt-in consent for other uses, potentially including marketing.
“Caesars Sportsbook does not currently have the necessary technology tools or processes to manage these new opt-in/opt-out and data sharing requirements,” the company wrote in its request. “Building the front-end functionality to collect opt-in consent across our services and designing, developing, and maintaining the back-end software and procedures to obtain and respect opt-ins/opt-outs will, in each case, be a very complicated, time-consuming project.”
Although the commission granted the official waiver request, commissioners and staff remained committed to the intent of the regulations.
“I did see candidly some of the language in the waiver requests is phrased in the form of some of the comments that were received, and I think at this point, the commission has made its point clear of what it wants to see,” said Mina Makarious, a partner with the Anderson Krieger law firm who has worked with the commission to craft regulations.
Commissioner Eileen O’Brien said she wanted to ensure the roundtable discussions were not simply a forum to relitigate the already-approved rules.
“We want to make sure it’s very narrowly tailored to the question of implementation and not going back policy-wise to re-argue, as opposed to really limited to tech and capacity to implement.”
As part of the roundtable, the commission may seek independent opinions on how viable it is to expect companies to enact the regulations prior to year’s end.
I think it would be interesting to have an independent expert on the tech to explain how heavy the lift is or isn’t in regards to what we’re looking at,” said commissioner Jordan Maynard. "It’s hard for me to put it in perspective."
“Is this something that can really be done quickly, and it’s just a matter of resources, or is this something that can’t be done quickly?"
