Operator GDPR compliance

Request

Can you tell me how bookmakers comply with GDPR? Are you policing this or holding them to account? Can you provide the rules by which you police them or refer them on? The single customer view which is proposed seems to break all the GDPR regulations? Please can you comment?

Response

Thank you for your request which has been processed under the Freedom of Information Act 2000 (FOIA).

In your email you have requested information relating to how bookmakers comply with GDPR? Further to this you have stated ‘Are you policing this or holding them to account? Can you provide the rules by which you police them or refer them on?’

The Gambling Commission license, regulate, advise and provide guidance to individuals and businesses that offer gambling in Great Britain, including the National Lottery in the UK

Our Licence Conditions and Codes of Practice (gamblingcommission.gov.uk) set out the requirements all our licensees must meet to in order to hold a Gambling Commission licence.

We carry out assessments to make sure that licensees are following our requirements.

We use our regulatory powers to take enforcement action if we find individuals or businesses failing to follow our rules and regulations.

However, it is the role of the Information Commissioners Office (ICO) to uphold information rights in the public interest. They are the independent regulatory office, dealing with the Data Protection Act 2018 (en.wikipedia.org)(opens in new tab) and the General Data Protection Regulation (en.wikipedia.org)(opens in new tab) across the UK.

Part of their role is to take action to ensure organisations meet their information rights obligations.

Finally you have stated ‘The single customer view which is proposed seems to break all the GDPR regulations? Please can you comment?’

Firstly, it should be noted that the FOIA gives individuals the right to request only recorded information held by public authorities, such as the Gambling Commission. It does not provide an avenue for individuals to gain views or opinions of public authorities or information not held at the time the request is made.

As this is not a request for recorded information, we are unable to process this question in line with FOI legislation. However, we have been working alongside the ICO to explore the challenges associated with finding a GDPR compliant solution to the 'single customer view' industry challenge.

In November 2020 the Commission were accepted into the Regulatory Sandbox (ico.org.uk)(opens in new tab), a service developed by the ICO, to support organisations who are creating products and services which utilise personal data in innovative and safe ways for public benefit.

The aim of the Single Customer View (SCV) Sandbox was to a) establish whether there is an appropriate lawful basis under Article 6 of the UK GDPR that allows for the sharing of behavioural data between online gambling operators via a SCV, including the examination of existing legal gateways, and b) consider the processing of special category personal data and the appropriateness of Article 9 conditions for processing under the UK GDPR.

The ICO has published its Regulatory Sandbox Phase 1 outcomes report (PDF)(ico.org.uk)(opens in a new tab).

Further information relating to this engagement can be viewed on the Gambling Commission website:

An update on the Single Customer View industry challenge (gamblingcommission.gov.uk)

Review of the decision

If you are unhappy with the service you have received in relation to your Freedom of Information request you are entitled to an internal review of our decision. You should write to FOI Team, Gambling Commission, 4th floor, Victoria Square House, Victoria Square, Birmingham, B2 4BP or by reply to this email.

Please note, internal review requests should be made within 40 working days of the initial response. Requests made outside this timeframe will not be processed.

If you are not content with the outcome of our review, you may then apply directly to the Information Commissioner (ICO) for a decision. Generally, the ICO cannot make a decision unless you have already exhausted the review procedure provided by the Gambling Commission.

The ICO can be contacted at: The Information Commissioner’s Office (opens in a new tab), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Information Management Team
Gambling Commission
Victoria Square House
Victoria Square
Birmingham B2 4BP