30Sep

Harris Hagan promotes Jessica Wilson to Senior Associate

30th September 2024 Harris Hagan 188

Harris Hagan is delighted to announce that Jessica Wilson will be promoted to Senior Associate with effect from 1 October 2024.

Jessica has been a tremendous asset to the firm since joining as a newly qualified solicitor in 2019, working on the specialist due diligence and licensing aspects of some of the largest M&A transactions in the gambling sector in recent years, as well as advising our clients generally on gambling law and regulatory matters.

We congratulate Jessica on her achievement and we are confident that she will contribute enormously to the continued success of the firm.

09Sep

Harris Hagan speaks at the Backing The Punt conference

9th September 2024 Harris Hagan 183

Harris Hagan is delighted to join the leading Australian gambling law firm Senet, virtually, for their two-day conference, Backing the Punt. The conference will focus on the issues, challenges and opportunities facing the betting and racing industry in Australia.

The event will take place on 11-12 September 2024 at the RACV City Club & Conference Centre in Melbourne. Partner, Bahar Alaeddini, will be joining virtually on 11 September 2024 to speak on the panel, International showcase – what are the trends and developments in international wagering, racing and sports betting?.

The panel will be moderated by Julian Hoskins, Principal at Senet, and the other panellists will include:

Ben Haden, Director of Research and Statistics at the British Gambling Commission
Scott Scherer, Shareholder at Brownstein Hyatt Farber Schreck
Joseph Borg, Partner, WH Partners

For full details and tickets, see Senet’s website.

02Sep

Global Gaming Women – Championing Inclusivity Webinar

2nd September 2024 Harris Hagan 174

On Tuesday 3 September 2024, at 12.45pm-2.15pm BST. Global Gaming Women (“GGW”) will host a webinar titled “Championing Inclusivity”.

The webinar will be co-moderated by Harris Hagan Partner, Bahar Alaeddini, and Christina Thor-Rankin (Principal Consultant 1710 Gaming). Together with the panellists, they will discuss the opportunities and challenges faced by women of colour in the industry.

The other panellists will include:

Monia Shafaq, Chief Executive Officer at Gordon Moody
Natasha Whittaker, Director of People Strategy, Operations and Governance at Games Global
Natasha Harris, Executive Director for People Services at the British Gambling Commission
Pallavi Deshmukh, Chief Executive Officer at NetGaming
Stephanie Wong, Head of Policy at the Betting and Gaming Council

To attend, please register here.

30Jul

Gambling Survey of Great Britain: Publication of first annual report

30th July 2024 Chris Biggs 221

After more than 3 years of development and significant industry scrutiny, the Gambling Commission published the first Gambling Survey for Great Britain (“GSGB”) Annual Report on 25 July 2024 (“GSGB Annual Report”).

In a press release announcing the publication, the Gambling Commission stated that this first edition features responses from 9,804 people “but will increase to around 20,000 by next year.” The Gambling Commission goes on to state that the GSGB Annual Report provides greater insight into attitudes and gambling behaviours:

“presenting a fuller picture, illuminating participation rates, the type of gambling activities participated in, experiences and reasons for gambling, and the consequences that gambling can have on individuals and others close to them.”

We have previously explained the GSGB’s structure and purpose in our blog Gambling Survey of Great Britain: Gambling Commission’s new approach to collecting gambling participation and prevalence data.

We now turn to the key facts outlined in the GSGB Annual Report and consider the information published by the Gambling Commission to support the GSGB.

Key Facts

The GSGB Annual Report highlights key facts from the data collected from adults aged 18 years and older living in Great Britain, summarised below.

Participation

48% of GSGB participants participated in any form of gambling in the past four weeks. This figure dropped to 27% when those who only participated in lottery draws were excluded.

GSGB participants were more likely to gamble online (37%) than in-person (29%), however this difference was largely accounted for by people who purchase lottery tickets online. Excluding those individuals, GSGB participants were more likely to gamble in-person (18%) than online (15%).

The most commonly reported gambling activities were the National Lottery (31%), purchasing tickets for other charity lotteries (16%) and buying scratchcards (13%). The average number of activities for those who had participated in gambling in the past 4 weeks was 2.2 activities during that period.

Experiences of and reasons for gambling

41% of GSGB participants who had gambled in the past 12 months rated the last time they gambled with a positive score (6 or above on a scale of 0 to 10), 37% expressed they neither loved nor hated it (score of 5) and 21% gave a negative score. When participating in lottery draws was excluded the pattern displayed a slightly higher proportion of positive scores, with 50% positive, 31% neutral and 19% negative.

The most common reasons that GSGB participants gambled were for the chance of winning big money (86%), because gambling is fun (70%), to make money (58%) and because it was exciting (55%).

Figure 11 of the GSGB Annual Report displays the full list of reasons for gambling in the past 12 months surveyed, represented below where the percentages comprise individuals who reported ‘sometimes’, ‘often’ or ‘always’ as a reason for gambling for each statement.

Notably, GSGB participants were also surveyed on the types of leisure activities in which they participated in the past 4 weeks. The vast majority of participants indicated they spent time with friends and family (98%), watched TV (95%) and listened to music (91%), with many also reported shopping (80%), eating out at restaurants (73%), participating in sports or exercise (64%), doing DIY or gardening (61%) or going to pubs, bars or clubs (50%).

Consequences from gambling

GSGB participants who had bet on non-sports events in person were over 9 times more likely than average to have a score of 8 or higher on the Problem Gambling Severity Index (“PGSI”), which represents problem gambling by which a person will have “experienced adverse consequences from their gambling and may have lost control of their behaviour.”

GSGB participants who had gambled on online slots were over 6 times more likely than average to have a PGSI score of 8 or higher.

41.4% of GSGB participants with a PGSI score of 8 or higher reported experiencing at least one of the severe adverse consequences asked about.

The severe adverse consequences surveyed required ‘yes’ or ‘no’ responses and consisted of: (1) losing something of significant financial value because of gambling; (2) relationship with spouse or partner or family member breaking down because of gambling; (3) experiencing violence or abuse because of gambling; and (4) committing a crime to fund gambling or pay gambling debts. Overall, 2.8% of GSGB participants who had gambled in the past 12 months reported experiencing at least one severe consequence.

The Gambling Commission also highlights that the GSGB is the first time that it has collected data on the consequences of someone else gambling. 47.9% of GSGB participants reported that someone close to them gambled. The most reported severe consequence of someone else gambling was the breakdown of a relationship with a spouse, partner or family member (3.5%).

Gambling Commission Guidance

To accompany the GSGB Annual Report, the Gambling Commission released Guidance on using statistics from the Gambling Survey for Great Britain (“GSGB Guidance”). The purpose of the GSGB Guidance is to ensure the GSGB data is reported correctly, with the Gambling Commission reiterating that these official statistics are new and are collected using a different methodology than previous official statistics.

The GSGB Guidance therefore lists the purposes for which the GSGB can and can’t be used, as well as where it can be used with some caution, in relation to the data on: (1) gambling participation; and (2) the consequences of gambling within the GSGB Annual Report. Of note, the GSGB can be used:

to look at patterns within the data amongst different demographic groups;
to assess future trends and changes in gambling participation and consequences of gambling, measuring changes against the 2024 baseline; and
to describe the range of consequences that someone may experience as a result of their own gambling and as a result of someone else’s gambling.

The GSGB can be used with some caution “until further work is completed”:

to provide estimates of gambling participation amongst adults in Great Britain;
to provide estimates of PGSI scores amongst adults in Great Britain; and
to provide estimates of the prevalence of consequences of gambling amongst adults in Great Britain.

The GSGB should not be used:

to provide direct comparisons with results from prior gambling or health surveys;
as a measure of addiction to gambling; and
to calculate an overall rate of gambling-related harm in Great Britain.

The GSGB Guidance also addresses the misuse of GSGB statistics. The Gambling Commission encourages the use of the statistics to support the understanding of important issues relating to gambling, but expects that “anyone using official statistics should present the data accurately and in accordance with the guidelines presented .”

Reiterating the message issued by Andrew Rhodes, Chief Executive Officer of the Gambling Commission, in his open letter to the industry in August 2023, if an individual or organisation is found to be using the GSGB inaccurately, the Gambling Commission “may contact them and request that they correct the statistics.” In “severe cases or continued misuse of official statistics”, the Gambling Commission may refer the individual or organisation to the Office of Statistics Regulation (“OSR”).

Whilst the Gambling Commission’s expectations for the use of the GSGB statistics have been made clear, it has not defined what it considers a “severe” case of misuse. However, the Gambling Commission’s Executive Director, Tim Miller, stated during the VIXIO Regulatory Intelligence webinar on 23 July 2024 that the Gambling Commission will challenge any misuse “in an appropriate way” such as by referral to the OSR, which has included “some examples in recent months where has taken those sorts of approaches.” We therefore encourage the industry to ensure its adherence with the GSGB Guidance.

Strengths and Limitations

The Gambling Commission has acknowledged that measuring adverse consequences from gambling in surveys is a challenging task, and cites Professor Patrick Sturgis’ statement in his Assessment of the Gambling Survey for Great Britain (GSGB):

“Given the widespread negative social norms around gambling, particularly harmful gambling, obtaining representative samples and accurate response data is at the more difficult end of what survey researchers seek to measure in general populations.”

Furthermore, the Gambling Commission states in its press release that Professor Sturgis warned that estimates of problem gambling rates should be used with caution due to the risk that the new methodology “substantially overstates the true level of gambling and gambling harm in the population.” The Gambling Commission updated its Gambling Survey for Great Britain – technical report to include a list of the GSGB’s strengths and limitations and caveats for the interpretation of PGSI score estimates produced in the GSGB.

Having set out these strengths and limitations, its expectations for the correct use of the GSGB statistics and the consequences for misuse, the Gambling Commission has seemingly attempted to temper the industry’s concerns about the accuracy and reliability of the new official statistics. During the VIXIO webinar, Miller stated that the Gambling Commission has listened to “recognised experts in data and statistics in developing the GSGB methodology”, as well as the GSGB Guidance. Acknowledging that all methodologies have limitations, Miller stated that a key difference is that the Gambling Commission is “very open and transparent about what the GSGB’s current limitations are”.

Miller defended criticism of the GSGB’s methodology and noted that the Health Survey for England is not without significant issues, having presented an “inflexibility” to update questions for relevance and an inconsistent method for the Gambling Commission to collect data on gambling activity. Miller confirmed the Gambling Commission continues to invest “a significant amount” into the GSGB methodology and is “confident that as to develop , this will become the new gold standard”.

Next Steps

The Gambling Commission explains that in a typical year, there will be four wave-specific publications from the GSGB, plus an annual report. In his blog accompanying the GSGB Annual Report, Ben Haden, Director of Research and Statistics at the Gambling Commission, explains that the GSGB removes its over-reliance on the PGSI as a “proxy for harms” and, even at a headline level, “a more general analysis of wider consequences and behavioural symptoms will give a far more nuanced picture than ever before.” Haden also states that two “in-depth reports” will be released before Christmas as the Gambling Commission commences its deeper analysis of the GSGB statistics.

Where the Gambling Commission acknowledges that the GSGB may overstate the true level of gambling and gambling harm in Great Britain, the release of the GSGB Annual Report will not calm industry concerns about the accuracy of these official statistics. Indeed, we share this concern where the proposals outlined in the White Paper may be evaluated, and potentially derailed, by these statistics. The Gambling Commission promised a “gold standard population survey for the whole of Great Britain”, in its effort to improve the quality, robustness and timeliness of official statistics on gambling behaviour in Great Britain: this is no doubt a challenging task. Therefore, noting Miller’s confidence in the GSGB as the Gambling Commission continues to develop the methodology, we will continue to follow the GSGB closely with the hope that the Gambling Commission moves closer to its aim.

Please get in contact with us if you have any questions about the GSGB Annual Report, the GSGB Guidance or how these statistics may impact your business.

30Jul

Baroness Twycross announced as new Gambling Minister

30th July 2024 Chris Biggs 157

On 26 July 2024, the Government announced that Baroness Fiona Twycross was appointed Minister for Gambling, in addition to her roles as Baroness in Waiting (Government Whip) and Parliamentary Under-Secretary of State at the Department for Culture, Media and Sport (“DCMS”).

Baroness Twycross has been a member of the House of Lords since November 2022 and previously held the roles of Opposition Whip and Shadow Spokesperson (Education) from February 2023 until the election. Prior to this appointment, Baroness Twycross had not contributed to gambling-related parliamentary debates, nor voted on any gambling-related legislation in the House of Lords.

However, in yesterday’s parliamentary debate on the Horseracing and Bloodstock Industries, Baroness Twycross made her first comments on the new Labour Government’s position regarding the horseracing betting levy, stating:

“… the previous Government undertook a review that concluded only in April. I am committed to working with noble Lords across the House to make sure that we get the right arrangements for the industry and the levy is administered efficiently to best support racing. It is too soon, however, for me to commit to the shape of future policy.”

Baroness Twycross also briefly addressed the topic of gambling reform and gambling-related harm:

“As stated in the Government’s manifesto, we are absolutely committed to strengthening protections for those at risk. The Gambling Commission’s new survey which came out last week really helps to show the wider picture of gambling behaviour across Great Britain, and we will consider its findings very carefully.”

The news of Baroness Twycross’ appointment followed a fortnight of industry speculation that Stephanie Peacock MP, who has also been appointed as a Parliamentary Under Secretary of State in DCMS, would also be appointed the gambling ministerial portfolio. Peacock was tipped for the role, having previously been the Shadow Minister for Media, Gambling and Sport and having recently contributed to parliamentary debates on the topic of gambling, including on the Football Index collapse and gambling advertising in sport, and having made a speech at the AGM of the Betting and Gaming Council in February.

Baroness Twycross’ comments in yesterday’s parliamentary debate come ahead of the House of Lords recess at the close of business today. The House of Lords will return on 2 September 2024.

26Jul

Account withdrawals: The mask operators cannot hide behind

26th July 2024 Jessica Wilson 207

On 18 July 2024, the Gambling Commission published a blog by Chief Executive, Andrew Rhodes, on its expectations on account withdrawals, which comes a year after it published its concerns regarding delays customers were experiencing when attempting to withdraw funds.

Whilst the Gambling Commission has seen a reduction in customer complaints regarding withdrawals, they remain the number one subject of complaints the Gambling Commission receives across all operator sizes. As stated in its previous blog, the Gambling Commission reminds operators that it is not acceptable to introduce friction when a customer tries to withdraw from their account, rather than when they deposit into the account, nor should they place their commercial interests over those of their consumers. The Gambling Commission’s blog details several issues it has encountered as part of its compliance work.

Issue 1: Explaining the reason for requesting additional information from the customer or the reason for not paying out

The Gambling Commission has seen operators requesting additional information from customers, as part of the withdrawal process without explaining to the customer the reason for requiring such information.

Under licence condition (“LC”) 17.1.1, operators must obtain and verify a customer’s identity before the customer is permitted to gamble. A customer request to withdraw funds must not result in a requirement for additional information to be supplied as a condition of withdrawal, if the operator could have reasonably requested that information earlier.

The Gambling Commission has reminded operators that it wants transparency for consumers on withdrawals, meaning operators “should make proper efforts to explain to customers what the checks and restrictions are” and that “customers should be informed of the reasons why their withdrawal has been delayed”.

The Gambling Commission has issued a warning that “where we find evidence that an operator has deliberately misled a customer in its communications with them, we will consider the need for regulatory action”.

However, the Gambling Commission does acknowledge that, where there is a knowledge or suspicion of money laundering offences being committed, operators must ensure customers are not tipped-off, which could result in committing an offence under the Proceeds of Crime Act 2002 (“POCA”).

Issue 2: Timing of requests for additional information

The Gambling Commission has seen cases where operators have asked a customer to provide source of funding information after a withdrawal request has been made, with the operator withholding the account balance until the source of funding requests have been satisfied.

Operators are expected to monitor customers’ accounts on an on-going and risk-sensitive basis. The lack of source of funding evidence, in this case, did not prevent the customer from being allowed to make deposits and gamble their funds.

The Gambling Commission has reminded operators that that if they do not have any regulatory concerns about a customer (such as suspicions of money laundering), then there is no valid reason to delay the payout of the withdrawal. Operators “should not…continue to accept deposits indefinitely and then seek to rely on their anti-money laundering procedure to frustrate a withdrawal request”.

Issue 3: Third-party payment methods

The Gambling Commission is aware of instances where an operator has suspected customers funding their accounts through third party payment methods, but only verifying that payment method after a withdrawal request has been made.

The use of third-party payment methods is classified as high risk in the Gambling Commission’s money laundering and terrorist financing risk assessment for the British gambling industry. It is therefore usual for operators to have terms and conditions in place to prevent customers using such payment methods. Where there is suspicion that an account may be funded by a third party, operators should ensure that any investigation is conducted promptly. The Gambling Commission considers it unfair to customers if operators accept deposits from third-party payment methods, but only makes enquiries when a withdrawal request is made.

Issue 4: Confiscation of customer deposits

The Gambling Commission has been made aware that operators sometimes seek to confiscate a customer’s deposit balance, either due to money laundering suspicions or because of a suspected breach of terms and conditions.

The Gambling Commission reminds operators of the offences and statutory requirements under POCA and the Terrorism Act 2000, and that confiscating or returning account funds where there is knowledge or suspicion of money laundering or terrorist financing could result in committing an offence, unless a defence has been sought.

The Gambling Commission further reminds operators of LC 7, which requires operators to ensure that the terms on which gambling is offered are not unfair. The Competitions and Markets Authority has published guidance on unfair terms, with one principle being that consumers should be allowed to withdraw their deposit balance at any time without restriction (except to comply with general regulatory obligations, including anti-money laundering and fraud prevention).

Other reminders

The Gambling Commission’s blog ends with some other useful reminders for operators:

Operators should not have terms that give them undue discretion as to when and how those terms are applied, as such terms could be unfair, as set out in the Gambling Commission’s guidance. For example, they should not have terms that say the operator “may” or “reserves the right” to void or withhold winnings in situations.
Operators must comply with consumer protection laws and treat customers in a fair, open and transparent way.
There may be reasons for an operator to seek further information from a customer for safer gambling purposes as part of a customer interaction, but operators should be transparent with their customers that the reason for requesting more information is for safer gambling purposes. However, the Gambling Commission confirms that it would not be “fair, transparent or necessary to delay or prevent withdrawals purely for customer interaction purposes”.

The Gambling Commission lastly states, “it is imperative that operators review their terms and practices on withdrawals on an ongoing basis, to ensure they are acting compliantly and are treating their customers fairly.”

The Gambling Commission’s blog makes it clear that a delay in processing a customer withdrawal could unmask other areas of non-compliance, including failing to conduct customer due diligence correctly, allowing a customer to gamble without sufficient identity or source of funding checks taking place or failing to verify third-party payment methods before being allowed to gamble

Attempting to correct these mistakes at the point a customer withdraws funds is a mask operators cannot hide behind, as the Gambling Commission has shown that it can see through these actions. Operators should review the Gambling Commission’s guidance in its blog and review their practices to ensure they do not make similar errors. The Gambling Commission’s confirmation that it is not afraid to take regulatory action is a clear warning to operators.

However, operators should not lose sight of their anti-money laundering responsibilities and obligations under POCA, the Terrorism Act 2000, the Licence Conditions and Codes of Practice, the Gambling Commission’s anti-money laundering guidance for casino businesses and for non-casino businesses, and the Money Laundering and Counter-Terrorist Financing (Information on the Payer) Regulations 2017.

If you have any questions or concerns regarding account withdrawals, your policies and processes, your terms and conditions, or your anti-money laundering and counter-terrorism financing responsibilities and obligations, please do reach out to your usual Harris Hagan contact, or get in touch with us here.

Please sign up to our blog to receive further news, insight and commentary.

24Jul

White Paper Series: UK Gambling Act Review: What Now? VIXIO Webinar

24th July 2024 Harris Hagan 202

On 23 July 2024, Bahar Alaeddini appeared as a panellist on a VIXIO Regulatory Intelligence webinar titled “UK Gambling Act Review: What Now?” together with Tim Miller from the Gambling Commission, Sarah Fox from the Department for Culture, Media and Sport and Dan Waugh from Regulus Partners, and moderated by Joe Ewens, Global Managing Editor from Vixio. This was the third webinar on the White Paper organised by Vixio. The panellists had an insightful and lively discussion about the current status of the White Paper proposals following the General Election:

Two earlier webinars took place on 16 May 2023, titled “The End of the Beginning”, 15 September 2023, titled “Defining the Future”. Please click on the dates to watch the earlier webinars.

27Mar

Harris Hagan promotes David Whyte to Partner

27th March 2024 John Hagan 202

Harris Hagan is delighted to announce that David Whyte will be promoted to Partner with effect from 1 April 2024.

David has been an enormous asset to the firm since joining in 2019, having previously worked in-house within the online and land-based sectors and for nine years at the Gambling Commission in both the enforcement and legal departments. His practical operational experience and unique insight into the gambling regulatory framework, aligned with his legal expertise and highly personable approach, has been invaluable to the firm and our clients, particularly on high-profile compliance and enforcement mandates, including some of the most significant cases in the recent history of the UK gambling industry.

David is recognised in the legal directories as “not only technical excellence to the firm but, importantly, an excellent understanding of the regulatory environment. His wider experience provides an invaluable contribution to strategic discussions.”

Bahar and I look forward to working in partnership with David as the firm continues to go from strength to strength in its 20^th year and enters a post-White Paper era for our clients.

11Mar

The Gambling Commission’s emerging money laundering and terrorist financing risks: February 2024 update

11th March 2024 Chris Biggs 231

The Gambling Commission released its most recent update on emerging money laundering and terrorist financing risks on 9 February 2024. This update covers five emerging risks that we set out in detail below.

Multiple cards and innovative payment methods

The Gambling Commission indicates that there are an increasing number of instances of “multiple stolen debit cards” being used to fund online gambling activities. Alongside virtual debit card products that allow multiple virtual debit cards to be linked to one bank account, these instances pose a significant money laundering and terrorist financing (“ML/TF”) risk.

The Gambling Commission points out the following (non-exhaustive) red flag indicators of which licensees should be mindful:

- the operator is unable to match the customer’s personal details with the card details;
- the operator does not have the ability to verify the card holder’s identity information; and
- there are multiple bank accounts being used to fund a customer’s gambling activity.

The Gambling Commission reminds licensees that they are required to have “robust customer due diligence and onboarding checks” in place. It points out that in accordance with Licence Condition (“LC”) 12 of the Licence Conditions and Codes of Practice (“LCCP”), licensees must review their ML/TF risk assessments as necessary in the light of “any changes of circumstances, including the introduction of new products or technology or new methods of payment by customers.” It also reminds licensees that they must consider whether checks on customer ID documents are sufficient to identify false, stolen or “mule” (third party) ID documents, in accordance with the identification and verification requirements set out in LC 17.1.1(1) and (4).

Risks associated with access to third party funds

The Gambling Commission states that customers who are in functions, roles or responsibilities that give them access to third party funds should be considered to present a higher inherent ML/TF risk. Such roles may include access to:

- the funds of vulnerable people;
- customer funds, in the case of banking, accounting or finance (for example);
- company funds; and
- charitable funds.

It points out that licensees should consider these risks at the start of the customer relationship and before any deposits are made, noting that in order to sufficiently identify these risks customer monitoring should be an ongoing process.

Updated FATF ‘grey list’

In stating that the Democratic Republic of the Congo, Mozambique and Tanzania have been added to the list of jurisdictions that are under an increased level of monitoring by the Financial Action Task Force (“FATF”), the Gambling Commission points out that these jurisdictions are placed on the FATF’s ‘grey list’ due to “strategic deficiencies in their regimes to counter money laundering, terrorist financing and proliferation financing.”

It reminds licensees to conduct robust customer due diligence checks in relation to any customer relationships associated with the jurisdictions on the FATF’s grey list in order to mitigate the risk of ML/TF, including proliferation financing.

The above-listed countries were added to the FATF’s grey list on 27 October 2023. However, it is important licensees note that following the Gambling Commission’s February 2024 update, the FATF announced on 23 February 2024 that Barbados and Gibraltar have been removed from the grey list. The FATF’s recent announcement and full grey list can be found here.

Funds originating from crypto-assets

The Gambling Commission states that it is aware of cases of licensees “not sufficiently” considering the risks associated with customer funds where the funds have originated from crypto-assets. It reminds licensees that it considers crypto-assets to be high risk and it expects licensees to “appropriately scrutinise transactions throughout the course of customer and business relationships.”

Common operator failings

The Gambling Commission states that there continues to be numerous instances of customers being able to deposit large amounts of money before the first anti-money laundering (“AML”) review can be undertaken by the licensee against a customer, due to insufficient and/or ineffective source of funds (“SOF”) checks and enhanced customer due diligence or KYC triggers.

It states that licensees have been identified as “failing to critically review SOF documentation” instead relying on electronic checks, which includes relying solely on open-source information, such as Companies House records, to verify SOF information. Other issues include licensees failing to provide sufficient guidance to staff on how to review and verify SOF information and to determine what supporting documents should be requested.

To mitigate these risks, the Gambling Commission recommends:

- setting realistic and effective monetary and non-monetary thresholds/triggers for determining when customer interactions should take place;
- carrying out such interactions earlier on in the customer relationship;
- ongoing customer monitoring (including monitoring all transactions or activity). The monitoring of customer activity should be carried out using a risk-based approach. Higher risk customers should be subjected to a frequency and depth of scrutiny greater than may be appropriate for lower risk customers; and
- considering geographical, customer, transactional and product risk in all customer relationships.

Next steps

As a reminder to licensees, LC 12.1.1(3) of the LCCP requires that all operating licence holders (with the exception of gaming machine technical and gambling software licences) ensure that their policies, procedures and controls for the prevention of money laundering and terrorist financing are “implemented effectively, kept under review, revised appropriately to ensure that they remain effective, and take into account any applicable learning or guidelines published by the Gambling Commission from time to time”.

We recommend that all licensees review their ML/TF risk assessments as soon as possible in the light of the Gambling Commission’s update. In addition to any necessary updates to their risk assessments, licensees must update their policies, procedures and controls to take into account any changes made.

Please get in contact with us if you require assistance reviewing your ML/TF risk assessment and/or your AML policies, procedures and controls.

07Mar

Is the cookie finally crumbling? ICO caution to UK websites on harmful online choice architecture

7th March 2024 Gemma Boore 205

On 31 January 2024, the UK’s Information Commissioner’s Office (“ICO”) published an update on its progress working with some of the UK’s top websites to ensure they comply with data protection law. The ICO also warned other organisations they must take steps to proactively ensure their use of advertising cookies and similar technologies are compliant.

This update follows the publication of an open letter by the ICO (which can be found here), in which it wrote to the Data Protection Officers (“DPOs”) of 53 of the UK’s top 100 websites (based on active time spent by UK users) warning that they would face enforcement action if they failed to ensure their website users had fair choices over whether or not to be tracked for personalised advertising within 30 days (the “Call to Action”).

In its January update, the ICO confirmed that there has been an “overwhelmingly positive response” to the Call to Action, with 38 of the 53 organisations contacted correcting their cookie banners and a further four committing to reach compliance within a month. In addition, several others are working to develop alternative solutions, including contextual advertising (which allows advertisers to target ads based on the page, app, video, or audio content being consumed, or the context in which it is being consumed, by the user without the use of cookies) and subscription models (which encourage the user to subscribe or sign-up to receive content / advertising), and the ICO promises to provide further clarity on how these models can be implemented in compliance with data protection law (at the time of writing, we are still awaiting this update).

In the meantime, and most importantly, the key message from the ICO is:

“We will not stop with the top 100 websites. We are already planning to write to the next 100 – and the 100 after that.”

In this article, we discuss the background to the Call to Action and consider what steps companies in the gambling sector (including both operators and affiliates) can take to ensure their websites are compliant with data protection and other relevant laws.

Background to the Call to Action

In November 2023, the ICO issued a public statement confirming that in its view, some UK websites were not ensuring that it was as easy for users to ‘reject all’ advertising cookies as it was to ‘accept all’: a topic upon which the ICO had recently published guidance. See:

joint blog from Stephen Almond, ICO’s Executive Director for Regulatory Risk and Will Hayter, the Competition and Markets Authority’s (“CMA”) Senior Director in the Digital Markets Unit: It’s time to end damaging website design practices that may harm your users; and
the ICO’s joint position paper with the CMA: Harmful design in digital markets: How online choice architecture practices can undermine consumer choice and control over personal information,

both of which cited those recovering from gambling addiction as examples of consumers that may see unwanted advertisements for gambling, particularly if they are “steered to accept all cookies” and that this may “encourage them to gamble, in turn leading to financial loss and possible negative impact on their mental health”.

In the ICO’s November 2023 public statement, Almond further explained:

“We’ve all been surprised to see adverts online that seem designed specifically for us – an ad for a hotel when you’ve just booked a flight abroad, for instance. Our research shows that many people are concerned about companies using their personal information to target them with ads without their consent… Many of the biggest websites have got this right. We’re giving companies who haven’t managed that yet a clear choice: make the changes now, or face the consequences.”

and once again, cited the targeting of gambling addicts as an example of bad practice.

Accordingly, it seems clear that gambling advertising is a subject already firmly caught within the crosshairs of the ICO, but what exactly do gambling operators and their marketing affiliates need to do?

The Call to Action

On 19 December 2023 (four weeks after the warning was first published), the ICO decided to publish a template version of its Call to Action letter to DPOs, to enable other UK website operators to understand its concerns, and proactively take action to address potential areas of non-compliance.

In the Call to Action letter, the ICO confirmed that it had assessed the relevant website’s cookie banners against three areas of concern:

Non-essential advertising cookies are placed before the website user has the opportunity to provide consent

This concerns instances where non-essential advertising cookies are placed either without any consent from users completely or before consent is requested. In each case, the ICO considers that this is unlikely to comply with consent requirements under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) and the UK retained EU law version of the General Data Protection Regulation (“UK GDPR”) because the user’s personal data would be processed without / before they had given valid consent.

Users can reject non-essential advertising cookies as easily as they can accept them

Some website operators display cookie banners with a button allowing users to immediately consent to all cookies (i.e. an ‘Accept All’ button that provides consent in one click), but do not incorporate a similar (i.e. equally prominent) mechanism for the user to refuse the placement of non-essential cookies as easily or in one click. The ICO’s concern is that, without such a mechanism, any consent obtained by a user clicking ‘Accept All’ on the cookie banner cannot be regarded as having been freely given, specific or informed (requirements for valid consent under the UK GDPR) in relation to each processing activity. Failure to obtain valid consent to the placement of non-essential marketing cookies and thus the processing of personal data, is unlikely to comply with PECR and UK GDPR.

Non-essential advertising cookies are placed even if the user did not consent to such cookies

Lastly, the ICO assessed whether website operators respect the choices of their users. In the ICO’s view, placement of non-essential advertising cookies and/or processing of personal data obtained via such cookies, in circumstances where the user has previously indicated that such cookies should not be placed, is unlikely to comply with PECR and UK GDPR.

Website operators were given one month to bring their website’s cookie banner into compliance or respond to the ICO, setting out: (a) the steps they plan to take; (b) why they are unable to take those steps within one month; and (c) the expected timescale for the implementation of those steps.

The Call to Action confirmed that the ICO would conduct a further assessment of the cookie banners on the recipient’s website in one month’s time to establish whether steps had been taken to improve compliance with PECR and UK GDPR.

Online Choice Architecture

As noted above (and in the Call to Action), on 9 August 2023 the ICO published a joint position paper with the CMA, which considered how online choice architecture (“OCA”) (i.e. the way information is presented and choices are structured online) could lead to data protection, consumer and competition harms.

The OCA position paper helpfully gave examples of OCA practices that the ICO and CMA jointly considered had the potential to harm consumers and explained how such practices could breach applicable laws including PECR, UK GDPR, and UK consumer protection laws including the Consumer Rights Act 2015.

Of relevance to the Call to Action, are the examples provided by the ICO / CMA in the OCA position paper, of “harmful nudges and sludge” techniques:

Harmful nudges (also called dark nudges): being when an organisation makes it easy or ‘nudges’ users to make inadvertent or ill-considered decisions; and
Sludge: being when an organisation creates unnecessary or unjustified friction or ‘sludge’ making it difficult for users to get what they want or do as they wish on the website.

The ICO and the CMA are concerned that the use of such techniques could encourage consumers to make choices they would not otherwise have made and that do not align with their best interests or preferences. This may include selecting less privacy-enhancing choices when personalising their privacy settings (e.g. by accepting all cookies including non-essential advertising cookies), thus allowing the organisation to process (and / or share) their personal data in ways that a user may not have intended or, in the absence of harmful nudges and sludge, have indicated to the organisation.

In the ICO’s view, use of these techniques is:

likely to infringe on Article 5(1)(a) of the UK GDPR, which requires that personal data is “processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)”; and
in turn, likely to breach Regulation 6 of PECR, which requires that users are: (a) provided with clear and comprehensive information about the purpose of cookies and; (b) given the opportunity to refuse them. In the ICO’s view, this means being given the opportunity to refuse non-essential cookies with the same ease as they can be accepted (e.g. by providing a ‘Reject All’ option as well (and as equally prominently) as an ‘Accept All’).

The CMA is additionally concerned that harmful nudges and sludge may confer a competitive advantage to certain large platforms; and inhibit entry and expansion by smaller businesses.

Next steps

The ICO has stated that it will continue to “steadily” work through its list of UK websites and advises all organisations to take action to become compliant now.

We therefore strongly recommend that DPOs of those in the gambling industry review their organisation’s mechanisms for obtaining consent to personalised advertising, including consents obtained via cookie banners, proactively to ensure these comply with data protection, consumer and competition laws. This applies to gambling operators and affiliates alike; not least because:

Gambling Commission licensees

Gambling Commission licenses are required by social responsibility code 5.1.6 of the Licence Conditions and Codes of Practice (“LCCP”) to ensure that all marketing of gambling products and services is undertaken in a socially responsible manner.

Failure to obtain valid consent to the processing of personal data, particularly that used for marketing, may therefore be considered a breach of the LCCP and lead to enforcement action by the Gambling Commission.

It is also worth noting that any enforcement action taken by the ICO / CMA against such companies would likely also attract the interest of the Gambling Commission; and

Marketing affiliates

Even though affiliates are not themselves regulated by the Gambling Commission, the licensed operators with whom they do business are, and accordingly:

- will be held responsible under social responsibility code 1.1.2 of the LCCP for the actions of third parties (such as affiliates) relating to the provision of marketing of licensed gambling; and
- are required to ensure their contracts enable them to terminate if, in their reasonable opinion, the third party is in breach of contract or has otherwise acted in a manner that is inconsistent with the licensing objectives.

Any enforcement action against affiliates by the ICO / CMA could therefore jeopardize affiliates’ relationships and potentially lead to the termination of their contracts with licensed British gambling operators.

In addition to reviewing cookie consent practices, we also suggest that DPOs consider whether any of the other examples of harmful OCA in the ICO / CMA position paper, including ‘confirm shaming’, ‘biased framing’, ‘bundled consent’ and ‘default settings‘, are being used by their organisation. It is likely that future ICO / CMA enforcement action will centre on such techniques and, in the case of bundled consent, this is already subject to a recently closed Gambling Commission consultation. For further discussion, please see our recent blog: White Paper Series: Direct marketing and cross-selling in the crossfire.

For the meantime we, along with the industry, await to see whether formal ICO enforcement action will be taken against any bad actors. It will also be very interesting to hear the ICO’s views on contextual advertising and subscription models – we will write a further blog if we consider these of key relevance to the gambling sector.

Please get in touch with us if you have any questions regarding harmful OCA, data privacy and / or consumer protection compliance for gambling businesses, or if you require any other assistance.

With thanks to Chris Biggs for his co-authorship.