I believe the new rules allow people to be given the data that a company has on them. So if SportsSpread owe money the data will either show that (i.e. they admit it) or they will deny having data or not respond which could get them in trouble under the GDPR rules. I think.
The first player to try this was successful. Kind of.
Betstars told a player they were suspending his account due to suspicions he was connected with another account using the same surname, they were locking his account and he could come back and ask again in Six Months and they would consider it again.
The player made a GPDR request asking for all info they held on him and what evidence they were using to connect him to criminality.
A coupld of days later the book sent him his balance and closed his account.
They did not supply the data requested though.