UKGC expects the industry to expedite trials of its Single Customer View solution

The Gambling Commission has published an update on the Single Customer View (‘SCV’) Industry initiative that was originally launched in February 2020, as reported at that time by us here.

That initiative arguably derived its name from an earlier recommendation by the Gambling Commission’s Digital Advisory Panel that the Commission should consider “requiring the large operators to form an arms-length joint venture that will provide a service that will consolidate a single customer view for all online gambling activity, so improved interventions are possible for both problem gamblers and gamblers at-risk. In parallel, the GC should continue to drive the agenda for research into markers of harm and specific gambling triggers so that this knowledge can be built into this service in the future”.

That recommendation was picked up the the Commission’s then CEO, Neil McArthur, in a speech that he delivered to a gambling industry audience in October 2019 (reported by us here), when he said:

Forthcoming Tech Sprint – How can we develop a ‘Single Customer view’?

Having a single view of the consumer has previously been described to me by someone senior in the industry as potentially being the ‘silver bullet’. While we remain of the view that a wide range of measures are necessary to put in place adequate protections, a single view would be an exciting development for all sorts of reasons. I also know that people have been looking into for a little while – it has been a constant feature of breakout sessions at a number of industry events, without yet becoming a viable tool for safer play.

We recognise the challenge of keeping a customer safe where operators currently only have a partial view of a customer’s behaviour. It’s similar to the position betting operators find themselves in when dealing with betting integrity cases, as each operator can only see it’s own customers betting patterns, whereas the SBIU can see the whole of the market and all the betting by specific individuals.

So, the challenge is: how can you do better with the information you have?

We know the technology capability exists to facilitate a single consumer view and making that work would significantly enhance player safety.

We want to build on and accelerate the work that has already taken place, by holding a collaborative ‘tech sprint’ bringing together the gambling industry, tech providers, data scientist, academics, researchers, Financial services providers and the Commission to plan a way forward.

  • We need your organisations to step forward to provide the right resource from your companies – leadership, financial, technical expertise, data, to make this happen. We want these first steps completed ahead of an event we will organise to provide support for participants.
  • We will organise this event for February.

We also know that GDPR compliance and compliance with LCCP will be at the forefront of your minds. With that in mind, while the tech sprint will be led by the Commission, we will be supported by the Information Commissioner’s Office (‘ICO’) in complying with data protection law and pushing ahead with innovative solutions in response to the challenge. Our teams will be in touch with you after this event to take this forward.

Clearly underlining its expectation that the gambling industry will move swiftly towards trialling its SCV solution” – now that the ICO has concluded that it may be lawful for gambling operators to share via a SCV behavioural data in order to identify individuals who may be ‘at-risk’ of gambling related harms – the Gambling Commission’s update states as follows (although we have added in blue below wording contained on pages 8 to 11 of the ICO’s own Regulatory Sandbox Phase 1 Outcome Report that has been omitted by the Gambling Commission):

An update on the Single Customer View industry challenge

We have been working alongside the ICO to explore the challenges associated with achieving a ‘single customer view’.

In February 2020 the Commission challenged the online gambling industry, represented by the Betting & Gaming Council (BGC), to explore and develop a ‘Single Customer View’ (SCV) solution which could enable a holistic view of a customer’s online gambling behaviour and help reduce gambling harms.

This cross-operator view of a customer’s gambling activities could help identify and prevent potential gambling harms in those who hold accounts with more than one gambling company. Online gamblers hold an average of three accounts, with a significant proportion of younger gamblers holding more. Our evidence also indicates an increased risk of harm among those customers who take part in multiple gambling activities1.

A SCV – which could take various forms – is an ambitious and complex undertaking, and it is therefore critical that the concept is properly considered and tested through the lens of data protection law.

In November 2020 we were accepted into the Regulatory Sandbox (opens in a new tab), a service developed by the Information Commissioner’s Office (ICO), to support organisations who are creating products and services which utilise personal data in innovative and safe ways for public benefit.

The aim of the SCV Sandbox was to (a) establish whether there is an appropriate lawful basis under Article 6 of the UK General Data Protection Regulation (‘UK GDPR’) that allows for the sharing of behavioural data between online gambling operators via a SCV, including the examination of existing legal gateways, and (b) consider the processing of special category personal data and the appropriateness of Article 9 conditions for processing under the UK GDPR.

We are pleased that the ICO has today published its Regulatory Sandbox Phase 1 outcomes report (PDF – opens in a new tab).

Key findings from the Sandbox Report

Following the completion of Phase 1 of the Sandbox, in summary, in respect of the proposed collection and processing of behavioural data via the SCV, the ICO’s view is that:

  • The sharing of behavioural data between gambling operators in order to identify individuals who may be ‘at-risk’ of gambling related harms via a SCV may be lawful under Article 6 (1)(e) ‘Public Task’ or Article 6 (1)(f) ‘Legitimate Interests’ of the UK GDPR:
    • ‘Public task’ requires there to be a basis in law, for the gambling operators to share the data for the SCV, and for that sharing to be carried out in the public interest. This does not require there to be a legal obligation, but there must be a domestic law from which this processing originates. While it is satisfied that this condition may apply, a further analysis of the specific circumstances will be needed (once the SCV has been further developed) to ensure the sharing is necessary and proportionate to meet those aims.
    • ‘Legitimate Interests’ encompasses the interests of a number of parties including those individuals at risk of problem gambling, the interests of gambling operators in meeting their legal requirements and those of society at large. These must be balanced against the interests and fundamental rights and freedoms of all the data subjects whose data may be shared. Again, it is satisfied that this condition may apply, but as the SCV is developed, a further analysis will be needed to consider how this condition applies in the specific circumstances.
  • Both lawful bases outlined above would provide a discretionary gateway to the processing. Both require an assessment of the proportionality of the processing when the benefits to those individuals who are at risk, are balanced against the potential detriment to all the data subjects whose data will be shared in connection with the SCV, and both allow for data subjects to object.
  • Should changes be made to gambling legislation, or if in the future the Commission inserted a new requirement into the Licence Conditions and Codes of Practice (‘LCCP’) about implementing the SCV, gambling operators may rely on Article 6 (1)(c) ‘Legal Obligation’ of the UK GDPR as the lawful basis for processing. Following the provision of this view, the Commission has indicated that it may be prepared to consult on introducing such a requirement into the LCCP, setting out an absolute requirement to share data via the SCVs12, however a change in legislation would likely take a substantial amount of time.
  • We will need to consider which parties are acting as controllers and processors in more detail if progressing to Phase 2 of the Sandbox plan.
  • The ICO is of the view that it is likely that some elements of the data proposed to be processed via a SCV may qualify as special category data. As processing special category data requires an Article 9 condition in the UK GDPR, it is good practice to identify this potential condition as early as possible, because the UK GDPR prohibits the processing of special category data without an Article 9 processing condition. It considers Article 9 (2)(g) ‘processing is necessary for reasons of substantial public interest’ may be appropriate.
  • In addition to the above, Schedule 1, Part 2, Paragraphs 18 ‘Safeguarding of children and individuals at risk’ or 19 ‘Safeguarding of economic well-being of certain individuals’ of the Data Protection Act 2018 (‘DPA 2018’) may be appropriate substantial public interest conditions to enable reliance on Article 9 (2)(g), but the applicability of these conditions will depend on the particular SCV model which is developed by industry.

Additionally, the ICO explained that for any processing to be lawful, all data protection principles outlined in Article 5 of the UK GDPR need to be complied with alongside other aspects of the UK GDPR, such as Article 25 data protection by design and by default. As explained in ICO guidance, lawfulness also means that you don’t do anything unlawful in a more general sense, which includes non-compliance with statute and common law obligations whether criminal or civil. As outlined earlier in [the] report, if the Commission continues into Phase 2 of its Sandbox participation, the focus will likely be on exploring potential data sharing solutions and considering wider compliance with the data protection legislation. 

It is important to note that a conceptual model for a SCV was considered for the purposes of the Sandbox, and the ICO’s view may be subject to change as the SCV solution is developed.

The full findings from Phase 1 are detailed in the outcomes report (PDF – opens in a new tab).

Next steps

The publication of the ICO’s report provides an important and helpful steer on how a SCV could be delivered in accordance with data protection law. However, there are still plenty of issues and complexities that need to be addressed as part of a pilot phase of work.

At this stage we have no plans to mandate a particular SCV solution – that is for industry to develop and test – but we do expect industry to demonstrate the impact its piloted solution has against the challenge we set.

We now expect industry to move swiftly towards trialling its SCV solution and invite them to do so in collaboration with us and the ICO, within a Sandbox environment.

Tim Miller, Executive Director at the Gambling Commission said:

“We welcomed the early commitment we received from gambling companies and their trade body to develop and trial a solution. However, we also recognised the questions that existed on how this could be achieved in a way that complied with data protection law. That is why we partnered with the Information Commissioner at an early stage and are pleased that they have been able to provide assurances that requirements on data protection need not be a barrier to making progress. We now look forward to the industry rapidly starting to pilot and then evaluate the approach they have developed to meet the challenge we have set of achieving a Single Customer View.”

Ian Hulme, Director of Regulatory Assurance at the ICO said:

“The vision behind the ICO Regulatory Sandbox was to create a space for organisations to test ideas and create products that have a real public benefit and make positive changes to society. Our work so far with the Gambling Commission has really brought that vision of the Sandbox to life. It has shown how organisations sharing data and working together can protect vulnerable users from gambling harms. We look forward to seeing how this project develops and welcome a future Sandbox submission from the Commission and industry.”

Gambling Minister Chris Philp said:

“We are determined to tackle problem gambling and we are undertaking a comprehensive review of our gambling laws to ensure they are fit for the digital age. I welcome the Information Commissioner’s Office findings that data can be shared safely and securely between operators to prevent problem gamblers running up crippling losses. It is essential that more action is taken to prevent people becoming dangerously addicted to gambling to the point that lives can be ruined. This is an important step towards protecting vulnerable people and operators must now come together to quickly deliver a meaningful solution.”

Note to editors

1 Pages 56 and 74 of the combined Health Survey 2016 hold data which shows that those who play more activities are more likely to be experiencing gambling harm.

You can download below (or access here) the ICO’s Regulatory Sandbox Phase 1 ‘outcome report’ (to which reference is made above). It clearly merits very careful reading because:

  • the issues of law arising are more complex than the Gambling Commission’s above statement might indicate and
  • the opinion expressed by the ICO in respect of the proposed collection and processing via the SCV of behavioural data is not rated any higher than possible, bearing in mind the ICO’s use of the word “may” when saying: “the sharing of behavioural data between gambling operators in order to identify individuals who may be ‘at-risk’ of gambling related harms via a SCV may be lawful”.

We have included within the wording shown in blue above (signifying the ICO’s words omitted from the  Commission’s update) reference to a footnote12 where the ICO’s ‘outcome report’ states “the Commission has indicated that it may be prepared to consult on introducing such a requirement into the LCCP, setting out an absolute requirement to share data via the SCVs12″.

That is an interesting footnote in terms of the Gambling Commission’s current expectations in relation to the issue of affordability. The ICO’s footnote12 states (with our emphasis in bold):

The ICO also considered whether amending the formal guidance on customer interaction (formal guidance under Social Responsibility Code 3.4.1: Customer interaction: formal guidance for remote gambling operators – Gambling Commission) to require the sharing of data via the SCV could be enough to demonstrate a legal obligation within the meaning of Article 6 of the UK GDPR. While this is arguable, on balance we consider that this would not be sufficient, as the Commission indicated that the remote customer interaction guidance does not form an absolute requirement; rather it presents additional information about how operators should implement the requirements, and which operators are required to take into account.

We await a response from the Betting and Gaming Council to the Gambling Commission’s SCV update.