Insights A win (of sorts) for the advocates of a Single Customer View

Contact

The UK Betting & Gaming Council has joined Phase 2 of the Single Customer View ICO Sandbox. Read our latest update here.

The potential for a ‘Single Customer View’ (the SCV) to become a reality first began to get real traction following a speech given by the-then CEO of the Gambling Commission in October 2019 in which he said:

“We recognise the challenge of keeping a customer safe where operators currently only have a partial view of a customer’s behaviour. It’s similar to the position betting operators find themselves in when dealing with betting integrity cases, as each operator can only see its own customers betting patterns, whereas the SBIU can see the whole of the market and all the betting by specific individuals.

So, the challenge is: how can you do better with the information you have?

We know the technology capability exists to facilitate a single consumer view and making that work would significantly enhance player safety.

We also know that GDPR compliance and compliance with LCCP will be at the forefront of your minds. With that in mind, while the tech sprint will be led by the Commission, we will be supported by the ICO in complying with data protection law and pushing ahead with innovative solutions in response to the challenge.”

As a concept, SVC is significantly more complicated than the above quote may suggest. Not only are there the obvious technical challenges, there are also legitimate concerns about the implications for personal freedoms, as well as privacy. It is in the context to the latter that the Gambling Commission acknowledged the role the British data protection regulator, the Information Commissioner’s Office (ICO) has to play.

Yesterday, the ICO published its initial thoughts on data sharing under the SCV. The regulator stated that gambling operators sharing behavioural data of their customers to prevent individuals from suffering harm may be lawful under the UK GDRP. It is important to stress that the ICO’s report is heavily caveated with the regulator repeatedly emphasising that the SCV’s compliance with UK GDPR will depend on many factors that are not yet known[1]. It should also be noted that the ICO did not pass comment on the incorporation of affordability data into the SCV, the use of which in discharging LCCP obligations relating to customer interaction has led to debate in the context of the GDPR.

The ICO’s analysis predominantly – and in the opinion of this author, correctly – focusses on whether there are any lawful bases under the UK GDPR which would apply to the proposed data sharing[2]. Processing of personal data will only be permitted where one of six lawful bases of the UK GDPR applies. The identification of an applicable lawful basis was always a possible stumbling block for the SCV, but the initial view of the ICO is that there are two, and possibly three, lawful bases that would permit the sharing of personal data of customers between operators in order to prevent harm.

The ICO highlights both public interest and legitimate interests as possible lawful bases for the processing proposed under the SCV. It also commented that processing could be permitted where it is necessary to comply with a legal obligation, however it was the ICO’s view that this would require an update to the LCCP (and not simply a change to any guidance)[3]. Clearly, any amendment to the LCCP requires the usual statutory consultation process.

The important takeaway for operators and for the SCV is that the ICO has accepted – albeit with those numerous caveats – that there are lawful bases that can apply to the sharing of personal data between operators.

The ICO also went on to identify that there would likely be lawful bases for the processing of special categories of personal data should this be shared, specifically health data relating to problem gambling. Special categories of personal data require additional lawful bases and the ICO has indicated that: safeguarding of children and individuals at risk; and safeguarding of economic well-being of certain individuals, would be applicable lawful bases in accordance with public interest.

The final points raised by the ICO related to the rights of objection (Article 21 of the UK GDPR) and automated decision-making (Article 22 of the UK GDPR), although no substantive opinions were given at this time.

In response to the ICO’s release, the Gambling Commission release its own, noting that:

The publication of the ICO’s report provides an important and helpful steer on how a SCV could be delivered in accordance with data protection law. However, there are still plenty of issues and complexities that need to be addressed as part of a pilot phase of work.”

Notably, the Gambling Commission also clearly stated that:

“At this stage we have no plans to mandate a particular SCV solution – that is for industry to develop and test – but we do expect industry to demonstrate the impact its piloted solution has against the challenge we set.”

The industry is collaborating on the SCV, as it did on responsible game design, use of ad tech and high-value customer schemes. Its ability to do so is clearly impacted on the work that clearly still needs to be done on the use of personal data for this purpose. However, whilst the ICO has not given its approval (unconditional or otherwise) to the gambling industry that data sharing under the SCV will be fine under data protection, it has passed up the opportunity to strike it down.  And that, for supporters of the SCV, must be considered a win of sorts.

The ICO’s publication  can be read in full here.

The Gambling Commission’s response can be read in full here.

[1] The unknown factors include: the precise personal data that will be shared under the SCV; and the specific technical specification, architecture, or construction of the SCV solution developed by industry.

[2] It must be borne in mind that this is just one part of the UK GDPR, and the implementation of the SCV would need to comply with all relevant parts of the UK GDPR.

[3] This author does not necessarily agree with the ICO’s view on the legal obligation lawful basis, however one would imagine that the LCCP will be updated to facilitate and implement the SCV and therefore any disagreement on the part of this author will likely be moot.