Information Commissioner’s Office Open Letter to UK Finance: A Call for Responsible Data Sharing in the Gambling Industry

United Kingdom (September 5, 2023) — In recent years, the gambling industry has seen significant growth, with online betting and gaming platforms becoming increasingly popular. However, this rapid expansion has also raised concerns about the potential for money laundering, fraud, and problem gambling. To address these issues, the UK Information Commissioner’s Office (ICO) issued an open letter to UK Finance (an industry body for banking and financial services) urging the association to support responsible data sharing for financial checks in the gambling industry.

The Growing Concerns

The gambling industry’s exponential growth has brought about a surge in transactions and financial activities, making it a hot spot for financial crime, including money laundering and fraud. Additionally, problem gambling is a growing societal issue, with many individuals suffering severe financial consequences due to addiction.

To mitigate these concerns, the ICO has taken a proactive stance, recognizing the importance of robust financial checks in the industry. In the open letter, ICO underscores the significance of responsible data sharing among financial institutions, gambling operators, and regulators to ensure a safer gambling environment. The ICO’s open letter emphasizes that data sharing should be conducted responsibly and in compliance with data protection laws such as the UK’s General Data Protection Regulation (UK GDPR).

Key Highlights of the ICO’s Open Letter

• Financial Risk Checks: Gambling operators are required to conduct “financial risk checks,” also known as “affordability checks,” to assess whether a customer’s gambling activity could pose harm in relation to their financial circumstances. The ICO acknowledges the need for such checks while ensuring that the privacy and data protection rights of individuals remain safeguarded.
• GDPR Compliance: The UK GDPR permits credit reference agencies to share personal information with gambling operators for the purpose of conducting financial risk checks. This is deemed acceptable by the ICO as it aligns the original purpose (credit risk assessment) closely with the new purpose (financial risk checks) for sharing such data.
• Data Protection Impact Assessment (DPIA): The ICO expects credit reference agencies to conduct a DPIA before processing personal information for financial risk checks. This assessment helps evaluate potential risks and outcomes, including the possibility of service denial.
• Robust Safeguards: Gambling operators are tasked with implementing stringent safeguards to ensure accurate and secure analysis of personal information obtained from credit reference agencies. Any misuse of such data for commercial gain could result in significant regulatory consequences.
• Necessity and Limitation: Data shared must be limited to what is essential for the purpose of financial risk checks. This underpins the GDPR principle of processing only relevant and necessary data.
• Preventing Financial Crime: Data sharing can help uncover financial transactions linked to money laundering and fraud, allowing for timely reporting to law enforcement agencies. This cooperation is crucial in protecting the industry’s integrity.
• Consent and Transparency: The ICO emphasizes the need for clear and informed consent from customers regarding the use of their financial data for responsible data sharing. Organizations must update their privacy notices and relevant accountability information to reflect an expanded scope of data sharing activities.
• Data Protection and Digital Information Bill: The ICO indicated that the forthcoming Data Protection and Digital Information Bill is expected to further clarify that processing personal data for new purposes is compatible with the original purpose when necessary to safeguard vulnerable individuals.

The ICO’s open letter to UK Finance is a significant step in addressing money laundering, fraud, and problem gambling within the gambling industry. Responsible data sharing, conducted in compliance with data protection laws, can enhance customer safety, promote responsible gambling, and protect the industry’s reputation.

By: Mike Pierides and Charlotte Roxon (Trainee solicitor Lovell Owiti contributed to this post).

View Original.

SOURCES: Morgan, Lewis & Bockius LLP / Lexology.