During a MDIA’s DiHubMT panel, Dr Marco Fagnano, Legal Counsel at Malta’s Information & Data Protection Commissioner (IDPC), highlighted the developing concerns of Artificial Intelligence (AI) in the gaming sector.

AI, on the one hand, promises great returns and rewards in the gaming sector but, on the other hand, jeopardises fundamental rights. In this respect, Dr Fagnano pointed out that as national data protection authority and fundamental rights authority (FRA) under the EU AI Act, ensuring conformity with the EU GDPR and the AI Act protects gaming players’ data privacy but also shields players, especially vulnerable players or players with addictive tendencies, from exploitative AI practices.

Dr Fagnano was speaking during a panel session as part of an information session for gaming operators on the implementation and compliance aspects of the EU AI Act. The event was organised by MDIA in collaboration with the Malta Gaming Authority.

Dr Fagnano cautioned that AI systems used for player profiling, personalized gaming experiences and monetisation are not just subject to article 22 of the GDPR, which restricts automated decisions that carry legal or similarly significant implications for individuals, but are also high-risk under the AI Act so as to qualify them as prohibited practices.

During the panel, attention was drawn to AI prohibited practices within the gaming sector which operators were incumbent to avoid, particularly.

AI Act Prohibited Practices

Manipulative AI (article 5(1)(a)) – AI gaming systems which deploy subliminal techniques or manipulative or deceptive techniques with the object of distorting player behaviour by impairing their ability to make an informed decision, causing them to take a decision they would have otherwise not taken – for e.g. AI powered algorithms which regulate emotion-triggered loot boxes which distort player behaviour.

Exploitation of vulnerabilities (article 5(1)(b)) – AI gaming systems which exploit user vulnerabilities in a way which causes them significant harm – for e.g. targeting at-risk groups of players (such as financially stressed players) with dynamic monetisation.

Social scoring (article 5(1)(c)) – AI gaming systems which record and create social securing datasets – for e.g. AI systems which would use secret player rankings to limit access or benefits which may be guaranteed under the gaming regulatory framework.

The IDPC therefore complimented the panel discussions to balance industry technological advancements, with the protection of fundamental rights, such as privacy and data protection which would, in parallel, also help to ensure gaming operators’ compliance with regulatory standards which may be in effect from time to time.