When asking them to close my account and delete all details, their reply was
We are required by Gibraltar law (The Gambling Act 2005) to keep account records for 5 years from the date on which a transaction took place. If we don’t do that, we would be in breach of the law and our licence. There is a provision in the Gibraltar Data Protection Act 2004 that allows data holders to retain data where it is required by law. After the expiry of the 5 year period we are free to permanently delete the data. In the meantime, if your account remains closed and unused, we would not use your data for any purpose other than to securely store it on our system for the 5 year period.
Are they within their rights to do this, can I ask them to do anything further such as encrypt the data?