It always must be the owners` responsibility. But it must be proved before. If the lost/sold your data, it must be proved. I don`t think that some private person can prove, that he shared his data only with one casino and soon he find it in the internet. And the stuff understand it.
But the same time - even federal services in my country sell your data, so i don`t see any way to save your data privacy.
I don't think there are staff who will sell the data of their customers because I don't know where the profit that can be obtained comes from, but for those who do know it might be an advantage, and if our data is lost either sold or purely lost it must be considered or as you say it must be proven. In addition, it is true what you said, I also doubt that there are people who really share their personal data with only one casino because usually when they are familiar with online gambling, they tend to be easily attracted by the many different advertisements and of course it is different casinos, when they lose at one casino, they will most likely gamble at other casinos, it makes sense because in my neighborhood there are many gamblers like this.
Is it really difficult to maintain personal data when it is connected to the internet? Doing online gambling does seem that personal data must be fulfilled, I myself do gambling only fill in a few of them including username, password, account number, sometimes email and referral code which I usually don't fill in. With email, sometimes I originate not using my own email, including the username. The important part is the account number and account name. Is it possible that they sell that data?