Information Commissioners Office respond to the GCF’s concerns about data sharing

What are Harms markers and are they working?

In November last year the GCF put forward concerns about the industry sharing and requested data. The original letter and response are below, what we note is the ICO state that any financial data shared cannot be used for any other purpose such as ‘wealth screening’ which suggests that requests for bank statements and payslips for affordability purposes are against the ICO rules. We will consider a response on this in the next few days.

I firstly want to clarify that our Regulatory Sandbox is a free service developed by the ICO to support organisations developing products and services that utilise personal data in innovative ways. The Sandbox is not a “sandbox for sharing data” and was not developed in collaboration with the Gambling Commission. Participants in the Sandbox have the opportunity to draw upon ICO expertise and advice on mitigating risks and embedding data protection by-design in their products.

Both the Gambling Commission and Betting and Gaming Council (BGC) used our Sandbox so the ICO could provide data protection advice while the single customer view (now known as GamProtect) was being developed. As you’ll be aware, the aim of GamProtect is to share data to reduce harm to gamblers. You might find the Gambling Commission’s Sandbox exit report and the BGC’s Sandbox exit report useful in understanding our role in the development of GamProtect and the advice we provided. Affordability checks were outside the scope of these Sandbox projects, however, we did provide separate advice on this topic in July last year.

We recognise that the financial risk check proposals from the Government and Gambling Commission are designed to protect individuals from unaffordable losses and debt. The ICO supports the sharing of financial data for this purpose where it is done transparently and proportionately. We have been clear that any financial data shared cannot be used for any other purpose such as ‘wealth screening’ and we will continue to work with the Gambling Commission on the design of the privacy safeguards in place for these checks.

As controllers of personal data, gambling operators are responsible for complying with data protection law, which we make clear during any interactions with the industry. Operators are expected to comply with the data protection principles – this includes the principle of lawfulness, fairness and transparency. Operators need to be transparent with the individual about what personal data they are collecting and what they will use the data for. They are expected to only use the minimum personal data required (the data minimisation principle) for their stated purpose only (the purpose limitation principle) and they are expected to be able to demonstrate their compliance with all the data protection principles (the accountability principle).

If an individual feels their personal data has been processed in a way that breaks data protection law, they should complain to the organisation they consider has done so and provide them with the opportunity to rectify the issue. If the individual is not satisfied with the organisation’s response, they can make a complaint to the ICO.

I cannot comment further on rules and regulations set out by the Gambling Commission as these fall outside our remit as the data protection regulator. I recommend contacting the Gambling Commission and the Financial Conduct Authority on questions relating specifically to the design and implementation of any impediments to withdrawal under their respective regimes.

We are writing to highlight the serious concerns of those using betting operators in relation to consumer documentation requests from companies in the gambling sector. 
We are well aware of the close relationship the ICO have enjoyed with the Gambling Commission in relation to developing a sandbox for sharing data. We now have reason to believe that operators are sharing information which is enabling them to root out consumers who target bookmakers for multi-accounting and other behaviours that lie outside terms and conditions. Whilst we as an organisation do not condone these practices, we do have to pose the question as to whether the ICO consider practices such as this – using data for commercial means instead of doing so to identify gambling harm. We would therefore be grateful if you could outline exactly what the parameters are with regards to the commercial uses of the sandbox, and how this is monitored by both the ICO and the Gambling Commission. 
In addition to this, we would be grateful if you could also outline the current ICO guidance and procedures relating to bookmakers requesting documentation from customers. It is well documented that this is a common practice at the stage a consumer makes a withdrawal request, with Anti Money Laundering being cited as the reasoning. However in a recent case bought before the Independent Betting Adjudication Service, Skybet had requested documentation and used the bank statements which were provided to identify a payment. This was then judged at third party funding and the bookmaker then enforced terms and conditions to not pay out winnings on the account.
Whilst we make no comment on the terms and conditions used by bookmakers, we would ask whether the ICO consider it appropriate for bookmaker firms to use information on bank statements in this way, which is clearly commercial, when the premise of the request was a different purpose. We understand DCMS will be looking a third party to handle enhanced affordability checks should they be implemented, and will not leave it to the bookmaker companies to handle such data. If this is the direction the Government are traveling in, then we would ask what guidance the ICO are providing bookmakers on the perimeters they can work to when requesting personal financial data and how the ICO supervises bookmakers to see they are not breaching the code of conduct.


Share this post:

Related Posts
Please subscribe to our regular newsletter detailing the progress we are making with our campaigns.