The UK Gambling Commission (UKGC) has published the first phase of its findings of a ‘Sandbox Review’, providing General Data Protection Regulation (GDPR) compliant feedback on the development of its ‘Single Customer View’ (SCV).
An objective of the UKGC’s new three-year national strategy has seen the commission establish an SCV solution to provide a “holistic view of a customer’s online gambling behaviour and help reduce gambling harms.”
The commission has called on the widest stakeholder input to develop an effective SCV, which will deliver a cross-operator view on a customer’s gambling habits to identify potential risks.
Tim Miller, UKGC Executive Director, said: “We welcomed the early commitment we received from gambling companies and their trade body to develop and trial a solution.
“However, we also recognised the questions that existed on how this could be achieved in a way that complied with data protection law. That is why we partnered with the Information Commissioner at an early stage and are pleased that they have been able to provide assurances that requirements on data protection need not be a barrier to making progress.”
Phase-1 of the Sandbox review aimed to establish whether an ‘appropriate lawful basis’ existed for the sharing of behavioural data between online gambling operators via an SCV.
It concluded that the SCV’s behavioural data to identify harms could qualify as a ‘Public Task’ or ‘Legitimate Interest’ under UK GDPR’s framework.
Additionally, the ICO was asked to consider if a gambling-sector SCV could be maintained as an ‘Article-9 GDPR special category’, allowing for the collection and processing of personal data under existing UK data laws.
A ‘Public Task’ requires there to be a basis in law for licensed operators to share the data under terms of the SCV, in which data sharing must be carried out in the interest of the public.
Meanwhile, ‘Legitimate Interests’ have to encompass the needs of several parties to maintain the legal requirements of a business sector and those of society at large.
The ICO deemed that both determinations offered the Commission’s SCV project a “discretionary gateway to processing data under UK GDPR”.
Furthermore, the UKGC was also advised to identify data processing elements of its SCV project that would require to be classified as a GDPR Article-9 category.
“We are determined to tackle problem gambling and we are undertaking a comprehensive review of our gambling laws to ensure they are fit for the digital age,” added Gambling Minister Chris Philp.
“I welcome the Information Commissioner’s Office findings that data can be shared safely and securely between operators to prevent problem gamblers running up crippling losses. It is essential that more action is taken to prevent people from becoming dangerously addicted to gambling to the point that lives can be ruined.
“This is an important step towards protecting vulnerable people and operators must now come together to quickly deliver a meaningful solution.”
