.svg)
Body
UK gambling operators sharing customer data to help cut problem gambling would probably be legal, according to a new report.
The Information Commission’s Office (ICO) said the sharing of behavioural data between gambling operators in order to identify individuals who may be at risk of gambling-related harm through a “single customer view” (SCV) may be lawful — either because it was a legal requirement of the operators or because there were “legitimate interests”.
The report follows the development of a “regulatory sandbox” to examine whether the sharing of customer data would be legitimate.
Gambling Commission executive director Tim Miller said he expected the industry to start trialling its SCV solution in collaboration with the regulator and the ICO.
“We welcomed the early commitment we received from gambling companies and their trade body to develop and trial a solution,” he said.
“However, we also recognised the questions that existed on how this could be achieved in a way that complied with data protection law.
“That is why we partnered with the Information Commissioner at an early stage and are pleased that they have been able to provide assurances that requirements on data protection need not be a barrier to making progress.
“We now look forward to the industry rapidly starting to pilot and then evaluate the approach they have developed to meet the challenge we have set of achieving a Single Customer View.”
If a SCV scheme can be brought in, it would help operators monitor gamblers’ activity across multiple accounts and allow them to more effectively intervene if there were concerns. This could include better enforcement of self-exclusion, where customers have accounts with different operators.
Earlier this year, acting chief executive Sam Gardner said one of the Gambling Commission’s major projects to help identify and protect vulnerable people from gambling-related harm was the development of an SCV — where it would be possible to see an overall picture of a gambler’s activity across different operators.
She said that although no gambling operator currently had a full picture of a customer’s gambling behaviour, an SCV would give operators a full picture of a customer’s risk of harm while keeping the customer’s data secure.
The ICO’s view was that the sharing of behavioural data between gambling operators may be lawful under Article 6(1)(e) “Public Task” or Article 6(1)(f) “Legitimate Interests” of the UK General Data Protection Regulation (GDPR).
It said the “public task” requirement needed a basis in law for gambling operators to share data, for instance a regulatory requirement, and for that to be the public interest. It said that although it was satisfied that this condition may apply, a further analysis of the specific circumstances would be needed.
The “legitimate interests" requirement encompasses the interests of parties including those individuals at risk of problem gambling, the interests of gambling operators in meeting their legal requirements and those of society at large. Again, the ICO said it was satisfied that this condition may apply, but further analysis was needed.
The ICO also considers the potential breach of individuals’ privacy in sharing the gambling data.
Ian Hulme, director of regulatory assurance at the ICO, said: “The vision behind the ICO Regulatory Sandbox was to create a space for organisations to test ideas and create products that have a real public benefit and make positive changes to society.
“Our work so far with the Gambling Commission has really brought that vision of the sandbox to life. It has shown how organisations sharing data and working together can protect vulnerable users from gambling harms.”
Gambling minister Chris Philp said: “We are determined to tackle problem gambling and we are undertaking a comprehensive review of our gambling laws to ensure they are fit for the digital age.
“I welcome the Information Commissioner’s Office findings that data can be shared safely and securely between operators to prevent problem gamblers running up crippling losses. This is an important step towards protecting vulnerable people and operators must now come together to quickly deliver a meaningful solution."
