An update on the Single Customer View industry challenge
07 October 2021
We have been working alongside the ICO to explore the challenges associated with achieving a 'single customer view'.
In February 2020 the Commission challenged the online gambling industry, represented by the Betting & Gaming Council (BGC), to explore and develop a ‘Single Customer View’ (SCV) solution which could enable a holistic view of a customer’s online gambling behaviour and help reduce gambling harms.
This cross-operator view of a customer’s gambling activities could help identify and prevent potential gambling harms in those who hold accounts with more than one gambling company. Online gamblers hold an average of three accounts, with a significant proportion of younger gamblers holding more. Our evidence also indicates an increased risk of harm among those customers who take part in multiple gambling activities1.
A SCV – which could take various forms – is an ambitious and complex undertaking, and it is therefore critical that the concept is properly considered and tested through the lens of data protection law.
In November 2020 we were accepted into the Regulatory Sandbox (opens in a new tab), a service developed by the Information Commissioner’s Office (ICO), to support organisations who are creating products and services which utilise personal data in innovative and safe ways for public benefit.
The aim of the SCV Sandbox was to a) establish whether there is an appropriate lawful basis under Article 6 of the UK General Data Protection Regulation (‘UK GDPR’) that allows for the sharing of behavioural data between online gambling operators via a SCV, including the examination of existing legal gateways, and b) consider the processing of special category personal data and the appropriateness of Article 9 conditions for processing under the UK GDPR.
We are pleased that the ICO has today published its Regulatory Sandbox Phase 1 outcomes report (PDF) (opens in a new tab).
Key findings from the Sandbox Report
Following the completion of Phase 1 of the Sandbox, the ICO’s view is that:
The sharing of behavioural data between gambling operators in order to identify individuals who may be ‘at-risk’ of gambling related harms via a SCV may be lawful under Article 6 (1)(e) ‘Public Task’ or Article 6 (1)(f) ‘Legitimate Interests’ of the UK GDPR:
‘Public task’ requires there to be a basis in law, for the gambling operators to share the data for the SCV, and for that sharing to be carried out in the public interest. This does not require there to be a legal obligation, but there must be a domestic law from which this processing originates. While it is satisfied that this condition may apply, a further analysis of the specific circumstances will be needed (once the SCV has been further developed) to ensure the sharing is necessary and proportionate to meet those aims.
‘Legitimate Interests’ encompasses the interests of a number of parties including those individuals at risk of problem gambling, the interests of gambling operators in meeting their legal requirements and those of society at large. These must be balanced against the interests and fundamental rights and freedoms of all the data subjects whose data may be shared. Again, it is satisfied that this condition may apply, but as the SCV is developed, a further analysis will be needed to consider how this condition applies in the specific circumstances.
Both lawful bases outlined above would provide a discretionary gateway to the processing. Both require an assessment of the proportionality of the processing when the benefits to those individuals who are at risk, are balanced against the potential detriment to all the data subjects whose data will be shared in connection with the SCV, and both allow for data subjects to object.
Should changes be made to gambling legislation, or if in the future the Commission inserted a new requirement into the Licence Conditions and Codes of Practice (‘LCCP’) about implementing the SCV, gambling operators may rely on Article 6 (1)(c) ‘Legal Obligation’ of the UK GDPR as the lawful basis for processing.
It is likely that some elements of the data proposed to be processed via a SCV may qualify as special category data. As processing special category data requires an Article 9 condition in the UK GDPR, it is good practice to identify this potential condition as early as possible, because the UK GDPR prohibits the processing of special category data without an Article 9 processing condition. It considers Article 9 (2)(g) ‘processing is necessary for reasons of substantial public interest’ may be appropriate.
In addition to the above, Schedule 1, Part 2, Paragraphs 18 ‘Safeguarding of children and individuals at risk’ or 19 ‘Safeguarding of economic well-being of certain individuals’ of the Data Protection Act 2018 (‘DPA 2018’) may be appropriate substantial public interest conditions to enable reliance on Article 9 (2)(g), but the applicability of these conditions will depend on the particular SCV model which is developed by industry.
For any processing to be lawful, all data protection principles outlined in Article 5 of the UK GDPR need to be complied with alongside other aspects of the UK GDPR, such as Article 25 data protection by design and by default. As explained in its guidance, lawfulness also means that you don’t do anything unlawful in a more general which includes non-compliance with statute and common law obligations whether criminal or civil.
It is important to note that a conceptual model for a SCV was considered for the purposes of the Sandbox, and the ICO’s view may be subject to change as the SCV solution is developed.
The full findings from Phase 1 are detailed in the outcomes report (PDF) (opens in a new tab).
Next steps
The publication of the ICO’s report provides an important and helpful steer on how a SCV could be delivered in accordance with data protection law. However, there are still plenty of issues and complexities that need to be addressed as part of a pilot phase of work.
At this stage we have no plans to mandate a particular SCV solution – that is for industry to develop and test – but we do expect industry to demonstrate the impact its piloted solution has against the challenge we set.
We now expect industry to move swiftly towards trialling its SCV solution and invite them to do so in collaboration with us and the ICO, within a Sandbox environment.
Tim Miller, Executive Director at the Gambling Commission said: “We welcomed the early commitment we received from gambling companies and their trade body to develop and trial a solution. However, we also recognised the questions that existed on how this could be achieved in a way that complied with data protection law. That is why we partnered with the Information Commissioner at an early stage and are pleased that they have been able to provide assurances that requirements on data protection need not be a barrier to making progress.
We now look forward to the industry rapidly starting to pilot and then evaluate the approach they have developed to meet the challenge we have set of achieving a Single Customer View.”
Ian Hulme, Director of Regulatory Assurance at the ICO said: “The vision behind the ICO Regulatory Sandbox was to create a space for organisations to test ideas and create products that have a real public benefit and make positive changes to society.
Our work so far with the Gambling Commission has really brought that vision of the Sandbox to life. It has shown how organisations sharing data and working together can protect vulnerable users from gambling harms.
“We look forward to seeing how this project develops and welcome a future Sandbox submission from the Commission and industry.”
Gambling Minister Chris Philp said:
"We are determined to tackle problem gambling and we are undertaking a comprehensive review of our gambling laws to ensure they are fit for the digital age.
I welcome the Information Commissioner’s Office findings that data can be shared safely and securely between operators to prevent problem gamblers running up crippling losses. It is essential that more action is taken to prevent people becoming dangerously addicted to gambling to the point that lives can be ruined.
This is an important step towards protecting vulnerable people and operators must now come together to quickly deliver a meaningful solution."
Note to editors
1Pages 56 and 74 of the combined Health Survey 2016 hold data which shows that those who play more activities are more likely to be experiencing gambling harm.
For all media enquiries, please contact the Gambling Commission press office.
Last updated: 27 March 2023
Show updates to this content
Following an audit corrected link formatting issues only.