The license really doesn't mean anything. Most of the time it's an employee that will sell the customer list. The casino doesn't even realize that the information is being sold. If there's a hack, then the casino knows but not an inside job. I was asked if I wanted a database for $20k USD but said no.
Your first-hand experience tells that this situation is indeed happening.
An inside job is always possible as some employees may be tempted for the money.
Some will offer to the black market and whoever has the highest bid, will get the database.
No doubt, you will receive unsolicited messages or emails, wondering how they did get a hold of your details?
Maybe, we can trust the casino, but the people or one of the staffs, will divert from his role and look for better pay.