The prospect of a “single customer view” moved a step forward last week, as the ICO published its Regulatory Sandbox Phase 1 outcomes report which concluded that the sharing of behavioural data between gambling operators in order to identify individuals who may be at risk of gambling related harms “may be” lawful under the UK GDPR.
In February 2020, the Gambling Commission challenged the gambling industry to explore a single customer view solution (SCV) which could enable a holistic, cross-operator view of a customer’s online gambling behaviour. Even by the Commission’s own admission this is an “ambitious and complex undertaking”, not least because it potentially raises complicated issues from a technical, data protection, privacy, consumer freedom and competition law perspective.
In November 2020, the Gambling Commission’s SCV project was accepted into the Information Commissioner’s Office (ICO) Regulatory Sandbox, which is a service offered by the ICO to support organisations who are developing products or services that use personal data in innovative ways and where such products or services deliver a potential public benefit.
The conceptual model considered by the ICO operates as follows: as an individual hits different trigger points, each individual online gambling operator will share the data with the SCV solution where in turn it will be subject to an algorithm that produces a ‘risk score’ or ‘banding’ for an individual. The ‘risk score’ or ‘banding’ will be shared with other online gambling operators and interventions are expected to be made based on an individual’s level of risk.
The aim of the SCV Sandbox was to:
establish whether there is an appropriate lawful basis under Article 6 of the UK GDPR that allows for the sharing of behavioural data between online gambling operators via a SCV, including the examination of existing legal gateways; and
consider the processing of special category personal data and the appropriateness of Article 9 conditions for processing under the UK GDPR.
The ICO concluded that “legitimate interests” and “public task/public interest” may be appropriate lawful bases under Article 6. The ICO also noted that a third lawful basis – “legal obligation” – could be available if the Gambling Commission updated the LCCP to require the use of the SCV (as it inevitably would, subject to the usual consultation process).
The ICO confirmed that certain behavioural data would likely constitute “special category data” under GDPR in certain circumstances (i.e. if gambling addiction (a mental health condition) is either being inferred with any degree of certainty or if that inference is deliberately drawn and influences activities in any way). To process this data, an Article 9 condition also needs to be satisfied. The ICO is of the view that “the processing is necessary for reasons of substantial public interest” may be an appropriate condition, as well as “safeguarding of children and individuals at risk.”
It is worth noting that the ICO’s report was littered with caveats. In particular, the ICO cautions that for the purposes of the Sandbox, a conceptual model of SCV was considered and that its conclusions could be subject to change due to factors such as the specific technical specification, architecture or construction of the SCV solution. The ICO also stressed that analysis would be required to ensure that the processing of data as envisaged for the SCV is necessary and proportionate (which no doubt will be the subject of some debate). It should also be noted that the ICO has not yet considered the sharing of affordability data (the scope of Phase 1 of the Sandbox was limited to behavioural data only).
Commenting on the ICO’s report, the Gambling Commission said:
“The publication of the ICO’s report provides an important and helpful steer on how a SCV could be delivered in accordance with data protection law. However, there are still plenty of issues and complexities that need to be addressed as part of a pilot phase of work.
At this stage we have no plans to mandate a particular SCV solution – that is for industry to develop and test – but we do expect industry to demonstrate the impact its piloted solution has against the challenge we set.
We now expect industry to move swiftly towards trialling its SCV solution and invite them to do so in collaboration with us and the ICO, within a Sandbox environment.”
The full press release from the Gambling Commission can be accessed here.