Licensing, Compliance and Enforcement Policy Statement
Request
Dear Sir/Madam
Under the Freedom of Information Act, I would like to request a copy of the data protection impact assessment, or equivalent review, assessment, research or investigation (including any board minutes or other records discussing the same) conducted by the Gambling Commission (or on its behalf) in respect of the impact of the Gambling Commission’s proposals in Proposal 9 of the consultation relating to its Licensing, Compliance and Enforcement Policy Statement (the “Policy Statement”) that, inter alia, amended the Policy Statement to confirm that the Gambling Commission may conduct remote compliance assessments for the purposes of determining whether activities are being carried on in accordance with the conditions of the operator’s licence or determining the suitability of the licensee to carry on the licensed activities.
I am interested in particular, in seeing a copy of the data protection impact assessment or other internal or external review, assessment, research or investigation, on the basis of which the Gambling Commission confirmed that it had “considered the proportionality and legality of using this method of assessment and was satisfied that we have appropriate controls in place to ensure that laws relating to data protection are complied with”. In addition, please provide me with any board minutes or other records of Gambling Commission officials or executives discussing the data protection impact of Proposal 9.
For further information, see your published response to Proposal 9 here:
Licensing, Compliance and Enforcement Policy: Consultation Response
Response
Dear REDACTED
Thank you for your request which has been processed under the Freedom of Information Act 2000 (FOIA).
In your email you have requested a copy of the data protection impact assessment (DPIA), or equivalent review, assessment, research or investigation (including any board minutes or other records discussing the same) conducted by the Gambling Commission (or on its behalf) in respect of the impact of the Gambling Commission’s proposals in Proposal 9 of the consultation relating to its Licensing, Compliance and Enforcement Policy Statement (the “Policy Statement”) that, inter alia, amended the Policy Statement to confirm that the Gambling Commission may conduct remote compliance assessments for the purposes of determining whether activities are being carried on in accordance with the conditions of the operator’s licence or determining the suitability of the licensee to carry on the licensed activities.
I can confirm that no information is held falling within the scope of your request.
The Gambling Commission’s enforcement powers, by virtue of the Gambling Act 2005, include the power to undertake compliance assessments on a unilateral basis. Further to this, the power to require licensees to produce records and information in such form as the Commission shall determine.
The latter power includes the ability for the Commission to designate remote means as the form and manner by which records, and information are to be produced or provided.
Since 2015, the Commission has conducted remote compliance assessments with remote operators. When this process was designed the Commission considered how to effectively identify data protection risks and introduced the necessary controls to minimise them.
More recently, due to the impact of Covid-19, the Commission adopted this approach across all operators, including land based, and continues to use this approach for assessments where it is deemed appropriate.
As the Commission had previously used this approach to assessments with remote operators, there was no change to the information that would ordinarily be collected as part of the assessment and the update to the Policy was simply a clarification of our already established approach; it was the Commission’s view that an impact assessment was not required. The Information Commissioner’s guidance on DPIA states: You must do a DPIA for processing that is likely to result in a high risk to individuals. This includes some specified types of processing’. Our view is that the remote compliance assessment does not meet this threshold and does not include any of the specified types of processing.
Review of the decision
If you are unhappy with the service you have received in relation to your Freedom of Information request you are entitled to an internal review of our decision. You should write to FOI Team, Gambling Commission, 4th floor, Victoria Square House, Victoria Square, Birmingham, B2 4BP or by reply to this email.
Please note, internal review requests should be made within 40 working days of the initial response. Requests made outside this timeframe will not be processed.
If you are not content with the outcome of our review, you may then apply directly to the Information Commissioner (ICO) for a decision. Generally, the ICO cannot make a decision unless you have already exhausted the review procedure provided by the Gambling Commission.
The ICO can be contacted at: The Information Commissioner’s Office (opens in a new tab), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Information Management Team
Gambling Commission
Victoria Square House
Victoria Square
Birmingham B2 4BP