20Jun

Reminder: Quarterly regulatory returns in force for all licensees from 1 July 2024

20th June 2024 Chris Biggs 119

On 1 July 2024, the Gambling Commission will update licence condition 15.3.1 of the Licence Conditions and Codes of Practice (“LCCP”) to require all licensees to submit their regulatory returns on a quarterly basis, within 28 days of the end of each quarterly period.

The Gambling Commission will also update its regulatory returns guidance from 1 July 2024, to remove guidance that applies to questions that will be removed from regulatory returns and amend the wording of guidance “in some cases” to clarify what data is required, based on feedback from licensees.

As we discussed in our previous blog, Quarterly regulatory returns across the board from July 2024, this change to the LCCP follows the Gambling Commission’s publication of its Frequency of regulatory returns: Consultation Response in March, and will harmonise regulatory return reporting dates across the industry.

The Gambling Commission has published information on its website to explain how it will transition licensees from their current regulatory returns reporting period, in addition to information about the questions it will be removing from regulatory returns from 1 July 2024, split by reference to licence type.

The first set of regulatory returns that will relate to the quarterly return period 1 July 2024 to 30 September 2024 must be submitted by 28 October 2024.

Importantly, licensees with current regulatory return periods containing 30 June 2024 will have their reporting period end date changed to 30 June 2024. In such cases, licensees may have shortened reporting periods and due dates. The Commission has published worked examples on its website, to illustrate how the reporting periods for different licence types will align.

The guidance also contains a reminder that once these changes have taken effect, licensees’ reporting periods will not, in most cases, reflect the regulatory year applicable to their licences, which will continue to be used to calculate the correct fee category, and thus annual fee, for operating licences.

If a licensee believes that they will exceed their fee category limit at any time after they have paid their annual fee, they must submit an application to vary their fee category to the Gambling Commission. Details of how to submit applications to vary licence fee categories can be found in the Gambling Commission’s guidance on how to make changes to your operating licence.

Please get in touch with us if you have any questions about regulatory returns and your obligations, licence fee categories, or if you would like assistance with any compliance or enforcement matters.

10May

Gambling Commission Corporate Strategy for 2024-2027

10th May 2024 Gemma Boore 136

On 8 April 2024, the Gambling Commission released its new Corporate Strategy for 2024 to 2027. The 20-page document, which is entitled ‘Gambling Regulation in the Digital Age’ highlights the most important work the Gambling Commission intends to deliver over the next three years (the “Corporate Strategy”).

Accompanying the release of the Corporate Strategy is a short video, in which the Gambling Commission states:

“We’re making better use of data and analytics to make our gambling regulation more effective, enhancing our core operational functions to provide best practice licensing, compliance and enforcement work, setting clear evidence-based requirements for licensees, being proactive in our approach and address potential problems at the earliest opportunity. And finally regulating a successful National Lottery.”

You can watch the Gambling Commission’s video here:

Introduction

The Corporate Strategy is introduced by a foreword from Marcus Boyle, Chair, and Andrew Rhodes, Chief Executive Officer and Commissioner of the Gambling Commission.

In the foreword, Boyle and Rhodes note that the way people gamble continues to evolve, and that, since the COVID-19 pandemic, studies have shown that fewer people report that they gamble regularly but consumers are collectively spending more money gambling than in 2019. Coupled with the accelerating development of new technologies, increasing globalisation of gambling business models and significant reforms to the regulation of gambling, Boyle and Rhodes declare that this is a “transformative period for the industry”.

The “ambitious” Corporate Strategy is thus underpinned by two main motivations focused on making gambling safer, fairer and free from crime:

Delivering on the decisions taken to bring about significant and lasting change to how gambling is provided, and the National Lottery is operated; and
Investing in key areas to improve how the Gambling Commission delivers its work for consumers, the public and licensees.

The Corporate Strategy sets out how the Gambling Commission commits to achieving these objectives in five areas of strategic focus, which it considers will have the biggest impact in delivering better outcomes for consumers, the public and licensees. Namely:

Using data and analytics to make gambling regulation more effective.
Enhancing core operational functions.
Setting clear evidence-based requirements for licensees.
Being proactive and addressing issues at the earliest opportunity.
Regulating a successful National Lottery.

We summarise the Gambling Commission’s commitments in each of these five areas below.

Using data and analytics to make gambling regulation more effective

Key Commitments

The Gambling Commission commits to:

significantly increasing the depth of its understanding of the gambling market and consumer behaviour;
using data science methods to improve early identification of issues and its understanding of industry compliance;
building a leading understanding of gambling-related harm; and
developing its internal capability to embed the effective use of data across all aspects of its work.

By making progress against its published evidence gaps and priorities, undertaking the Gambling Survey for Great Britain (about which we have written in a previous article) and investing in its own people, the Gambling Commission states that consumers, the wider public and licensees will benefit from better outcomes resulting from the Gambling Commission’s better regulation.

Progress metrics

The Gambling Commission will measure its progress against these commitments by:

assessing itself against the Government Data Maturity Framework;
annually auditing its data science capacity and testing the progress of improvement in its data tools;
publishing regulator updates on changes in the gambling sector and its views for the future;
demonstrating improvement of its understanding of outcomes and approach to evaluation; and
evidencing how its assessment of risk has improved through timely, targeted and effective interventions.

Enhancing the Gambling Commission’s core operational functions

Key Commitments

The Gambling Commission commits to:

evolving its licensing, compliance and enforcement work including improving its core processes, technology and related approaches, which it intends will result in processes, approaches and systems being “digital by default”, and “a more responsive and automated experience for applicants and licensees”;
developing its approach to assurance including increasing transparency of industry compliance levels by theme and licensee – this means that the Gambling Commission will start routinely publishing findings from its work to assess compliance with requirements relating to fairness, protection from harm and crime prevention in 2024 – without identifying specific licensees; and
increasing investment, resources and capacity to tackle illegal gambling.

Progress metrics

The Gambling Commission will measure its progress in this focus area by:

publishing its improved performance against key operational performance indicators;
reporting on levels of industry compliance, building an initial benchmark and then demonstrating positive trends towards greater compliance; and
publishing the metrics on the impact of its disruption activities relating to illegal gambling operators and highlighting case studies.

The Gambling Commission will also explore the availability of reliable proxies to help estimate the scale and risk posed by the illegal market in Great Britain.

Setting clear, evidence-based requirements for licensees

Key Commitments

The Gambling Commission commits to:

delivering the measures it is responsible for in the White Paper, including improving player protections and product safety;
increasing its capacity to evaluate new requirements and policies; and
reviewing how it communicates its requirements and related guidance to licensees and the public.

Progress metrics

To measure its progress in this focus area, the Gambling Commission will continue to report on the progress of its White Paper commitments, publish the results of its evaluation and research outputs, and support the Government and others in their evaluation of the impact of the White paper reforms.

Being proactive and addressing issues at the earliest opportunity

Key Commitments

The Gambling Commission commits to:

investing in a programme of activities exploring how licensees can be supported to meet their responsibilities to consumers and the wider public; and
increasing the resource available to improve its understanding of issues which pose a risk to the fair and open licensing objective.

Progress metrics

The Gambling Commission states that the number of licensees demonstrating an understanding of standards and increased compliance rates will serve to measure its progress in this focus area, as will identifying key metrics such as consumer sentiment on whether gambling is fair and can be trusted. Notably, the Gambling Commission intends to reduce its reliance on formal enforcement tools to secure compliance and focus its efforts more on those who fail to comply.

Regulating a successful National Lottery

Key Commitments

The Gambling Commission commits to:

completing its oversight and assurance of the transition to, and implementation of, the Fourth National Lottery licence;
embedding its regulatory approach to the Fourth National Lottery licence; and
assessing how well the benefits from the new licence arrangements are realised.

So long as player protection is maintained and improved, the Gambling Commission will permit the new National Lottery licensee, Allwyn, to use more freedom and commercial judgement to innovate for the benefit of consumers and the wider public.

Progress metrics

The Gambling Commission will use a combination of qualitative and quantitative methods to assess both its progress in this focus area, and Allwyn’s performance against each of its duties, to ensure that performance does not diminish under the operation of the new licensee.

Next steps

The Gambling Commission’s progress in each of the five focus areas will be reported within its annual reports.

Insight

The objectives in the Corporate Strategy are clear. The Gambling Commission is committing to improving the way that it regulates, and it is doing this by: (1) making better use of data; (2) enhancing its own operational functions; (3) setting clear (and importantly, evidence-based) requirements; (4) being proactive; and finally (5) ensuring that the first transition to a new National Lottery licensee in the last three decades, goes smoothly.

All laudable aims, but from our perspective we will be particularly keen to see the Gambling Commission deliver on its commitment to create more efficiencies in its licensing, compliance, and enforcement work. By its own admission, the Gambling Commission’s “core technology and systems are reaching the limits of their capabilities”. Investing in new technologies (provided they are effective, economic, and properly utilised) can only be a positive step for a public body. After all, the gambling industry is often noted for being at the cutting-edge of technology – so it is only appropriate that its regulator should be, too.

We also welcome the announcement that the Gambling Commission will begin publishing the findings of its compliance work this year, without identifying individual licensees. While this is of course important in the context of sanctions and regulatory settlements; this sporadic means of communication can make it difficult for the wider industry to learn from others’ failings. By consolidating anonymised compliance findings relating to fairness, protection from harm and crime prevention into one report, say quarterly, the Gambling Commission is giving all of those that are licensed by it a fairer chance to (i) understand and (ii) comply with its requirements in the future.

The pressure is now on the Gambling Commission to deliver on extensive commitments, not just in the Corporate Strategy but also those imposed on it by the Government in the White Paper. Challenging times lie ahead, and it is in stakeholders’ interests that the Gambling Commission delivers (and is held to account) on its promises. Positive signs are plentiful under Andrew Rhodes’ now established leadership, not least with important new internal appointments in key positions, a genuinely consultative response to its critical summer 2023 consultation on proposed changes to the LCCP and RTS, trial and pragmatism in relation to financial risk checks and meaningful engagement with industry and other key shareholders. Stakeholders may therefore have reason to be optimistic that the Gambling Commission can deliver upon its ambitious corporate strategy, and we are sure its progress will be monitored closely!

With sincere thanks to Chris Biggs for for his invaluable co-authorship.

Please get in touch with us if you would like assistance with any compliance or regulatory matters.

27Mar

Harris Hagan promotes David Whyte to Partner

27th March 2024 John Hagan 150

Harris Hagan is delighted to announce that David Whyte will be promoted to Partner with effect from 1 April 2024.

David has been an enormous asset to the firm since joining in 2019, having previously worked in-house within the online and land-based sectors and for nine years at the Gambling Commission in both the enforcement and legal departments. His practical operational experience and unique insight into the gambling regulatory framework, aligned with his legal expertise and highly personable approach, has been invaluable to the firm and our clients, particularly on high-profile compliance and enforcement mandates, including some of the most significant cases in the recent history of the UK gambling industry.

David is recognised in the legal directories as “not only technical excellence to the firm but, importantly, an excellent understanding of the regulatory environment. His wider experience provides an invaluable contribution to strategic discussions.”

Bahar and I look forward to working in partnership with David as the firm continues to go from strength to strength in its 20^th year and enters a post-White Paper era for our clients.

25Mar

Match or no match: Camelot IWG Appeal dismissed

25th March 2024 Chris Biggs 130

On 1 March 2024, the Court of Appeal dismissed an appeal in Parker-Grennan v Camelot UK Lotteries Ltd EWCA Civ 185, in relation to Ms Joan Parker-Grennan’s (“JPG”) appeal against the High Court’s decision to refuse summary judgment for her claim against Camelot UK Lotteries Ltd (“Camelot”).

In our previous blog Match or no match: the million-pound question for the High Court, we summarised the case and analysed the High Court’s decision. In this blog, we remind readers of the background and then outline the key points to note in the Court of Appeal’s dismissal.

Background

On 25 August 2015, JPG purchased a £5 ticket to play an Instant Win Game (“IWG”) on Camelot’s website. During the IWG, an interim (and optional) animated display appeared, showing that JPG had matched two different numbers:

Number 15, which would have resulted in JPG winning a prize of £10 and was flashing with a corresponding message to confirm the win; and
Number 1, which would have resulted in JPG winning a prize of £1 million, but there were no flashing lights or messages to reflect this.

JPG applied for a summary judgment alleging it was clear she was entitled to £1 million in addition to the £10 prize.

The High Court accepted Camelot’s defence: JPG was entitled to the £10 prize only, because this amount had been “predetermined” by a computer as the prize that would be won for JPG’s ticket. The coding issue, which was responsible for the optional animations on the IWG, was irrelevant to the question of whether a player had won a prize.

Importantly, this reflected Camelot’s Game Procedures, IWG rules and account terms that made clear that the interim animated display was irrelevant to the question of whether a player had won a prize (the prize had been predetermined by Camelot’s computer system) and which were properly incorporated into the contract between JPG and Camelot.

Court of Appeal decision

The Court of Appeal considered the three broad issues from the High Court decision: the (1) incorporation, (2) enforceability (i.e. fairness), and (3) construction (i.e. interpretation) of the terms and conditions on Camelot’s website. Lady Justice Andrews, in providing the leading judgment, considered each of the three issues in order, preceding her analysis with the following remark:

“he short answer to this appeal is that, even as a matter of construction of those terms which she did accept were applicable and binding upon her, had won only £10, not £1 million, and accordingly the was right. Thus the answer to the construction issue obviates the necessity to answer either of the other questions.”

Nevertheless, Her Honour went on to outline the Court of Appeal’s reasoning on each issue:

Incorporation

LJ Andrews agreed that there was no requirement for Camelot to specifically signpost any of the relevant terms and conditions in order to incorporate them into the customer contract, as a matter of common law.

The question of whether Camelot had done enough to reasonably draw the terms and conditions to the notice of JPG was “quintessentially one of fact” and Her Honour disagreed with the High Court’s opinion that simply following a “click-wrap” procedure (i.e. clicking a button marked “confirm” in response to the words “Accept terms and conditions”) would be sufficient to incorporate all the standard terms and conditions in every case of an online contract for goods or services. However, in this case, she concluded it was clear that JPG would see, upon opening her online account, that there were overarching terms and conditions, as well as specific terms relating to the IWGs and Game Procedures. JPG had also been invited to read and confirm her acceptance of any significant updates to the terms and conditions.

In short, LJ Andrews concluded that the “existence of the terms could not have come as a surprise” to JPG; Camelot had done enough to incorporate the relevant terms and conditions into the contract.

Enforceability

LJ Andrews agreed with the High Court’s assessment of enforceability in this context (i.e. where none of the terms were individually negotiated) turning on whether, contrary to the requirement of good faith, any particular term caused a “significant imbalance in the parties’ rights and obligations arising under the contract, to the detriment of the consumer” pursuant to Regulation 5 of the Unfair Terms in Consumer Contracts Regulations 1999. Her Honour further noted if a term was regarded as unfair it would be unenforceable against the consumer, but the remainder of the contract would – if capable of continuing in existence without that term – continue to bind the parties.

Assessing the facts of the case, LJ Andrews agreed with the Judge that the network of contractual provisions on which Camelot relied were clearly drafted and well signposted through the various hyperlinks (unlike in the case of Green v Betfred which we discussed in our previous blog), noting that JPG had “a real opportunity of becoming acquainted with the terms of the contract before she clicked the “I Accept” button”.

Construction

Further to Her Honour’s preliminary summary of her assessment of the construction issue (see above), LJ Andrews noted if JPG had read the Game Procedures it would have been clear that in order to win the prize, JPG needed to click through to the end of the game by clicking “FINISH”. When JPG did this, the outcome was that it was clear she had won £10, not £1 million.

In summing up, her Honour stated:

“Indeed I consider that all of this should have been obvious to any reasonable player of the even if they did not read the Game Procedures.”

Conclusion

As discussed in our previous blog, this case presents a flickering ray of hope for an industry in which some operators had resigned themselves to settling consumer claims, then quickly issuing proceedings against their B2B suppliers. To the extent the applicable game rules and terms and conditions are properly incorporated, fair and accurately drafted, they ought to be enforceable – even against consumers.

Indeed, LJ Andrews concludes her judgment by adding that although she dismissed JPG’s appeal, this case has highlighted the complexity of balancing the needs of traders to publicise their terms and conditions, with the needs of consumers to access and understand those terms, finally noting that:

“…given that a decade has passed since the last report of the Law Commission the time might be ripe for another, evidence based, review of this area of law.”

Whether that transpires, or not, is a question for another blog.

If you are a B2C gambling operator, please get in touch. We can help you draft website terms and conditions, rules of play and other gambling contracts that are compliant, valid and enforceable.

11Mar

The Gambling Commission’s emerging money laundering and terrorist financing risks: February 2024 update

11th March 2024 Chris Biggs 157

The Gambling Commission released its most recent update on emerging money laundering and terrorist financing risks on 9 February 2024. This update covers five emerging risks that we set out in detail below.

Multiple cards and innovative payment methods

The Gambling Commission indicates that there are an increasing number of instances of “multiple stolen debit cards” being used to fund online gambling activities. Alongside virtual debit card products that allow multiple virtual debit cards to be linked to one bank account, these instances pose a significant money laundering and terrorist financing (“ML/TF”) risk.

The Gambling Commission points out the following (non-exhaustive) red flag indicators of which licensees should be mindful:

- the operator is unable to match the customer’s personal details with the card details;
- the operator does not have the ability to verify the card holder’s identity information; and
- there are multiple bank accounts being used to fund a customer’s gambling activity.

The Gambling Commission reminds licensees that they are required to have “robust customer due diligence and onboarding checks” in place. It points out that in accordance with Licence Condition (“LC”) 12 of the Licence Conditions and Codes of Practice (“LCCP”), licensees must review their ML/TF risk assessments as necessary in the light of “any changes of circumstances, including the introduction of new products or technology or new methods of payment by customers.” It also reminds licensees that they must consider whether checks on customer ID documents are sufficient to identify false, stolen or “mule” (third party) ID documents, in accordance with the identification and verification requirements set out in LC 17.1.1(1) and (4).

Risks associated with access to third party funds

The Gambling Commission states that customers who are in functions, roles or responsibilities that give them access to third party funds should be considered to present a higher inherent ML/TF risk. Such roles may include access to:

- the funds of vulnerable people;
- customer funds, in the case of banking, accounting or finance (for example);
- company funds; and
- charitable funds.

It points out that licensees should consider these risks at the start of the customer relationship and before any deposits are made, noting that in order to sufficiently identify these risks customer monitoring should be an ongoing process.

Updated FATF ‘grey list’

In stating that the Democratic Republic of the Congo, Mozambique and Tanzania have been added to the list of jurisdictions that are under an increased level of monitoring by the Financial Action Task Force (“FATF”), the Gambling Commission points out that these jurisdictions are placed on the FATF’s ‘grey list’ due to “strategic deficiencies in their regimes to counter money laundering, terrorist financing and proliferation financing.”

It reminds licensees to conduct robust customer due diligence checks in relation to any customer relationships associated with the jurisdictions on the FATF’s grey list in order to mitigate the risk of ML/TF, including proliferation financing.

The above-listed countries were added to the FATF’s grey list on 27 October 2023. However, it is important licensees note that following the Gambling Commission’s February 2024 update, the FATF announced on 23 February 2024 that Barbados and Gibraltar have been removed from the grey list. The FATF’s recent announcement and full grey list can be found here.

Funds originating from crypto-assets

The Gambling Commission states that it is aware of cases of licensees “not sufficiently” considering the risks associated with customer funds where the funds have originated from crypto-assets. It reminds licensees that it considers crypto-assets to be high risk and it expects licensees to “appropriately scrutinise transactions throughout the course of customer and business relationships.”

Common operator failings

The Gambling Commission states that there continues to be numerous instances of customers being able to deposit large amounts of money before the first anti-money laundering (“AML”) review can be undertaken by the licensee against a customer, due to insufficient and/or ineffective source of funds (“SOF”) checks and enhanced customer due diligence or KYC triggers.

It states that licensees have been identified as “failing to critically review SOF documentation” instead relying on electronic checks, which includes relying solely on open-source information, such as Companies House records, to verify SOF information. Other issues include licensees failing to provide sufficient guidance to staff on how to review and verify SOF information and to determine what supporting documents should be requested.

To mitigate these risks, the Gambling Commission recommends:

- setting realistic and effective monetary and non-monetary thresholds/triggers for determining when customer interactions should take place;
- carrying out such interactions earlier on in the customer relationship;
- ongoing customer monitoring (including monitoring all transactions or activity). The monitoring of customer activity should be carried out using a risk-based approach. Higher risk customers should be subjected to a frequency and depth of scrutiny greater than may be appropriate for lower risk customers; and
- considering geographical, customer, transactional and product risk in all customer relationships.

Next steps

As a reminder to licensees, LC 12.1.1(3) of the LCCP requires that all operating licence holders (with the exception of gaming machine technical and gambling software licences) ensure that their policies, procedures and controls for the prevention of money laundering and terrorist financing are “implemented effectively, kept under review, revised appropriately to ensure that they remain effective, and take into account any applicable learning or guidelines published by the Gambling Commission from time to time”.

We recommend that all licensees review their ML/TF risk assessments as soon as possible in the light of the Gambling Commission’s update. In addition to any necessary updates to their risk assessments, licensees must update their policies, procedures and controls to take into account any changes made.

Please get in contact with us if you require assistance reviewing your ML/TF risk assessment and/or your AML policies, procedures and controls.

07Mar

Is the cookie finally crumbling? ICO caution to UK websites on harmful online choice architecture

7th March 2024 Gemma Boore 140

On 31 January 2024, the UK’s Information Commissioner’s Office (“ICO”) published an update on its progress working with some of the UK’s top websites to ensure they comply with data protection law. The ICO also warned other organisations they must take steps to proactively ensure their use of advertising cookies and similar technologies are compliant.

This update follows the publication of an open letter by the ICO (which can be found here), in which it wrote to the Data Protection Officers (“DPOs”) of 53 of the UK’s top 100 websites (based on active time spent by UK users) warning that they would face enforcement action if they failed to ensure their website users had fair choices over whether or not to be tracked for personalised advertising within 30 days (the “Call to Action”).

In its January update, the ICO confirmed that there has been an “overwhelmingly positive response” to the Call to Action, with 38 of the 53 organisations contacted correcting their cookie banners and a further four committing to reach compliance within a month. In addition, several others are working to develop alternative solutions, including contextual advertising (which allows advertisers to target ads based on the page, app, video, or audio content being consumed, or the context in which it is being consumed, by the user without the use of cookies) and subscription models (which encourage the user to subscribe or sign-up to receive content / advertising), and the ICO promises to provide further clarity on how these models can be implemented in compliance with data protection law (at the time of writing, we are still awaiting this update).

In the meantime, and most importantly, the key message from the ICO is:

“We will not stop with the top 100 websites. We are already planning to write to the next 100 – and the 100 after that.”

In this article, we discuss the background to the Call to Action and consider what steps companies in the gambling sector (including both operators and affiliates) can take to ensure their websites are compliant with data protection and other relevant laws.

Background to the Call to Action

In November 2023, the ICO issued a public statement confirming that in its view, some UK websites were not ensuring that it was as easy for users to ‘reject all’ advertising cookies as it was to ‘accept all’: a topic upon which the ICO had recently published guidance. See:

joint blog from Stephen Almond, ICO’s Executive Director for Regulatory Risk and Will Hayter, the Competition and Markets Authority’s (“CMA”) Senior Director in the Digital Markets Unit: It’s time to end damaging website design practices that may harm your users; and
the ICO’s joint position paper with the CMA: Harmful design in digital markets: How online choice architecture practices can undermine consumer choice and control over personal information,

both of which cited those recovering from gambling addiction as examples of consumers that may see unwanted advertisements for gambling, particularly if they are “steered to accept all cookies” and that this may “encourage them to gamble, in turn leading to financial loss and possible negative impact on their mental health”.

In the ICO’s November 2023 public statement, Almond further explained:

“We’ve all been surprised to see adverts online that seem designed specifically for us – an ad for a hotel when you’ve just booked a flight abroad, for instance. Our research shows that many people are concerned about companies using their personal information to target them with ads without their consent… Many of the biggest websites have got this right. We’re giving companies who haven’t managed that yet a clear choice: make the changes now, or face the consequences.”

and once again, cited the targeting of gambling addicts as an example of bad practice.

Accordingly, it seems clear that gambling advertising is a subject already firmly caught within the crosshairs of the ICO, but what exactly do gambling operators and their marketing affiliates need to do?

The Call to Action

On 19 December 2023 (four weeks after the warning was first published), the ICO decided to publish a template version of its Call to Action letter to DPOs, to enable other UK website operators to understand its concerns, and proactively take action to address potential areas of non-compliance.

In the Call to Action letter, the ICO confirmed that it had assessed the relevant website’s cookie banners against three areas of concern:

Non-essential advertising cookies are placed before the website user has the opportunity to provide consent

This concerns instances where non-essential advertising cookies are placed either without any consent from users completely or before consent is requested. In each case, the ICO considers that this is unlikely to comply with consent requirements under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) and the UK retained EU law version of the General Data Protection Regulation (“UK GDPR”) because the user’s personal data would be processed without / before they had given valid consent.

Users can reject non-essential advertising cookies as easily as they can accept them

Some website operators display cookie banners with a button allowing users to immediately consent to all cookies (i.e. an ‘Accept All’ button that provides consent in one click), but do not incorporate a similar (i.e. equally prominent) mechanism for the user to refuse the placement of non-essential cookies as easily or in one click. The ICO’s concern is that, without such a mechanism, any consent obtained by a user clicking ‘Accept All’ on the cookie banner cannot be regarded as having been freely given, specific or informed (requirements for valid consent under the UK GDPR) in relation to each processing activity. Failure to obtain valid consent to the placement of non-essential marketing cookies and thus the processing of personal data, is unlikely to comply with PECR and UK GDPR.

Non-essential advertising cookies are placed even if the user did not consent to such cookies

Lastly, the ICO assessed whether website operators respect the choices of their users. In the ICO’s view, placement of non-essential advertising cookies and/or processing of personal data obtained via such cookies, in circumstances where the user has previously indicated that such cookies should not be placed, is unlikely to comply with PECR and UK GDPR.

Website operators were given one month to bring their website’s cookie banner into compliance or respond to the ICO, setting out: (a) the steps they plan to take; (b) why they are unable to take those steps within one month; and (c) the expected timescale for the implementation of those steps.

The Call to Action confirmed that the ICO would conduct a further assessment of the cookie banners on the recipient’s website in one month’s time to establish whether steps had been taken to improve compliance with PECR and UK GDPR.

Online Choice Architecture

As noted above (and in the Call to Action), on 9 August 2023 the ICO published a joint position paper with the CMA, which considered how online choice architecture (“OCA”) (i.e. the way information is presented and choices are structured online) could lead to data protection, consumer and competition harms.

The OCA position paper helpfully gave examples of OCA practices that the ICO and CMA jointly considered had the potential to harm consumers and explained how such practices could breach applicable laws including PECR, UK GDPR, and UK consumer protection laws including the Consumer Rights Act 2015.

Of relevance to the Call to Action, are the examples provided by the ICO / CMA in the OCA position paper, of “harmful nudges and sludge” techniques:

Harmful nudges (also called dark nudges): being when an organisation makes it easy or ‘nudges’ users to make inadvertent or ill-considered decisions; and
Sludge: being when an organisation creates unnecessary or unjustified friction or ‘sludge’ making it difficult for users to get what they want or do as they wish on the website.

The ICO and the CMA are concerned that the use of such techniques could encourage consumers to make choices they would not otherwise have made and that do not align with their best interests or preferences. This may include selecting less privacy-enhancing choices when personalising their privacy settings (e.g. by accepting all cookies including non-essential advertising cookies), thus allowing the organisation to process (and / or share) their personal data in ways that a user may not have intended or, in the absence of harmful nudges and sludge, have indicated to the organisation.

In the ICO’s view, use of these techniques is:

likely to infringe on Article 5(1)(a) of the UK GDPR, which requires that personal data is “processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)”; and
in turn, likely to breach Regulation 6 of PECR, which requires that users are: (a) provided with clear and comprehensive information about the purpose of cookies and; (b) given the opportunity to refuse them. In the ICO’s view, this means being given the opportunity to refuse non-essential cookies with the same ease as they can be accepted (e.g. by providing a ‘Reject All’ option as well (and as equally prominently) as an ‘Accept All’).

The CMA is additionally concerned that harmful nudges and sludge may confer a competitive advantage to certain large platforms; and inhibit entry and expansion by smaller businesses.

Next steps

The ICO has stated that it will continue to “steadily” work through its list of UK websites and advises all organisations to take action to become compliant now.

We therefore strongly recommend that DPOs of those in the gambling industry review their organisation’s mechanisms for obtaining consent to personalised advertising, including consents obtained via cookie banners, proactively to ensure these comply with data protection, consumer and competition laws. This applies to gambling operators and affiliates alike; not least because:

Gambling Commission licensees

Gambling Commission licenses are required by social responsibility code 5.1.6 of the Licence Conditions and Codes of Practice (“LCCP”) to ensure that all marketing of gambling products and services is undertaken in a socially responsible manner.

Failure to obtain valid consent to the processing of personal data, particularly that used for marketing, may therefore be considered a breach of the LCCP and lead to enforcement action by the Gambling Commission.

It is also worth noting that any enforcement action taken by the ICO / CMA against such companies would likely also attract the interest of the Gambling Commission; and

Marketing affiliates

Even though affiliates are not themselves regulated by the Gambling Commission, the licensed operators with whom they do business are, and accordingly:

- will be held responsible under social responsibility code 1.1.2 of the LCCP for the actions of third parties (such as affiliates) relating to the provision of marketing of licensed gambling; and
- are required to ensure their contracts enable them to terminate if, in their reasonable opinion, the third party is in breach of contract or has otherwise acted in a manner that is inconsistent with the licensing objectives.

Any enforcement action against affiliates by the ICO / CMA could therefore jeopardize affiliates’ relationships and potentially lead to the termination of their contracts with licensed British gambling operators.

In addition to reviewing cookie consent practices, we also suggest that DPOs consider whether any of the other examples of harmful OCA in the ICO / CMA position paper, including ‘confirm shaming’, ‘biased framing’, ‘bundled consent’ and ‘default settings‘, are being used by their organisation. It is likely that future ICO / CMA enforcement action will centre on such techniques and, in the case of bundled consent, this is already subject to a recently closed Gambling Commission consultation. For further discussion, please see our recent blog: White Paper Series: Direct marketing and cross-selling in the crossfire.

For the meantime we, along with the industry, await to see whether formal ICO enforcement action will be taken against any bad actors. It will also be very interesting to hear the ICO’s views on contextual advertising and subscription models – we will write a further blog if we consider these of key relevance to the gambling sector.

Please get in touch with us if you have any questions regarding harmful OCA, data privacy and / or consumer protection compliance for gambling businesses, or if you require any other assistance.

With thanks to Chris Biggs for his co-authorship.

23Feb

White Paper Series: Gambling Commission update on its implementation of financial risk checks

23rd February 2024 Chris Biggs 150

Yesterday, the Gambling Commission’s Executive Director of Research and Policy, Tim Miller, published a blog updating the industry on the Gambling Commission’s implementation of its widely publicised proposals for financial risk checks.

In accordance with the Government’s commitments in the White Paper, the Gambling Commission commenced its consultation on the two proposed forms of financial risk checks in its Summer 2023 consultation on proposed changes to Licence Conditions and Codes of Practice (LCCP), Remote Gambling and Software Technical Standards (RTS), and arrangements for Regulatory Panels (the “Summer 2023 Consultation”).

Having now “considered responses to the , alongside evidence and research”, and in advance of Parliament’s debate on financial risk checks next week (Monday 26 February 2024), Mr Miller provides further information about how the Gambling Commission intends to implement the financial risk checks proposed in the Summer 2023 Consultation.

Financial risk checks

In the Summer 2023 Consultation, the Gambling Commission proposed: (1) “light touch” financial vulnerability checks using publicly available data at moderate levels of spend, such as £125 net loss within a rolling 30-day period or £500 net loss within a rolling 365-day period (“Financial Vulnerability Checks”); and (2) enhanced financial risk assessments at unusually high levels of loss, such as (for over 25’s) £1,000 net loss within a rolling 24 hours or £2,000 net loss within a rolling 90-day period (“Financial Risk Assessments”).

Whilst the Gambling Commission has not yet published its response to the Summer 2023 Consultation (the “Consultation Response”), Mr Miller’s blog sets out the Gambling Commission’s intended next steps for implementing the Financial Vulnerability Checks and Financial Risk Assessments ahead of its “responses to these consultation topics next month”.

Financial Vulnerability Checks

Mr Miller confirms that, “following feedback through the consultation” these “rictionless, light touch” checks will focus solely on publicly available data and will not require operators to consider customers’ personal details, such as their postcode or job title. The aim of the Financial Vulnerability Checks is to identify vulnerabilities, such as “where a customer is subject to bankruptcy orders or has a history of unpaid debts.”

Notably, the Gambling Commission will introduce the requirements for Financial Vulnerability Checks in two stages “o ease the introduction of these checks”. They will initially come into force at a higher threshold for a short period of time before reverting to a lower threshold later in the year “to smooth implementation for consumers”. Mr Miller states that further details will be set out in the Consultation Response.

Financial Risk Assessments

The Gambling Commission has, in considering responses to the Summer 2023 Consultation, agreed that a pilot is the most appropriate way to implement the Financial Risk Assessments in a careful manner. This, he states, will enable the Gambling Commission to “test the details of data-sharing in practice, working with credit reference agencies and gambling businesses, thinking always about what this means for the consumer” (the “Pilot”).

The Pilot is expected to run for a period of approximately four to six months and will involve a “selection of operators” (such as betting and casino operators of different sizes). Licensees will not be expected to act on the data they receive during the Pilot but must remain compliant with existing regulatory requirements and will be “expected to continue to protect consumers by implementing their own existing consumer safety controls.”

To enable the Pilot, the Gambling Commission will set out a requirement in its Licence Conditions and Codes of Practice to “facilitate the data-sharing and build in data protection requirements.”

Mr Miller sets out five principles that will guide the Gambling Commission’s actions throughout the Pilot:

The Gambling Commission will consider all issues that arise from the Pilot and is clear that this will help refine the final requirements and the models for data-sharing. This will help ensure the intentions and commitments within the White Paper are met.
As set out in the White Paper, the Gambling Commission wants a system that means conducting an assessment is frictionless for the vast majority of customers who undergo them.
The Gambling Commission wants an overall customer interaction process that can help customers who are at risk of harm.
Financial Risk Assessments are only one part of the controls and protections that are in place – the Gambling Commission does not seek to make them a standalone approach to tackle harm.
The Pilot is separate from the Gambling Commission’s formal evaluation of the policy, which is a distinct and important longer-term process. Understanding consumer perspectives and experiences is a vital part of this longer-term evaluation.

Alongside the Pilot, the Gambling Commission will continue to gather data which will inform the final thresholds and definitions of loss or spend for implementation following the Pilot.

Further details of the Pilot and data period will be set out in the Consultation Response.

Next steps

Mr Miller states that the Gambling Commission has been working closely with the Department for Culture, Media and Sport “to ensure that the next steps closely reflect the intention of the White Paper.” It will therefore be interesting to hear both the Government’s and Parliament’s position on financial risk checks during the Parliamentary debate that commences at 4:30pm on Monday (26 February 2024). The debate can be viewed here.

The Consultation Response will be published in March.

Please get in touch with us if you have any questions about financial risk checks or if you would like assistance with any compliance or enforcement matters.

16Feb

Chambers Global 2024 Legal Rankings

16th February 2024 Harris Hagan 156

Harris Hagan continues to have four lawyers individually ranked for Chambers & Partners’ Global Market Leaders Rankings (Gaming & Gambling).

We are proud to have the quality of our work in the gambling industry recognised by the prestigious legal directories and will always strive for the highest standards for our valued clients.

John Hagan (Band 1) has been praised as a “leading practitioner” for gaming and gambling matters and recognised for often assisting with “high-value international transactions”.

Bahar Alaeddini (Band 2) has been recognised for her “specific expertise” with global gaming and gambling matters, including her frequent work on regulatory and licensing matters.

Julian Harris has been recognised with the esteemed position of Senior Statesperson and commended for his “wealth of experience” regularly assisting clients with licence reviews and compliance investigations. Commentary has praised Julian as “very switched on.”

Last, but certainly not least, Hilary Stewart-Jones also continues to occupy the position of Senior Statesperson and has been recognised as a “noted figure” in the industry. Commentary has emphasised her status as “very well connected and very knowledgeable for the UK market.”

21Dec

DCMS Committee on gambling regulation publishes its report

21st December 2023 Francesca Burnett-Hall 163

The Department for Culture, Media and Sport (“DCMS”) Committee on gambling regulation, appointed by the House of Commons, has today published its report with its conclusions and recommendations to Government.

The inquiry launched in December 2022, at a time when there was considerable uncertainty about the status of the Gambling White Paper. The original terms of reference were as follows:

What is the scale of gambling-related harm in the UK?
What should the key priorities be in the gambling White Paper?
How broadly should the term ‘gambling’ be drawn?
Is it possible for a regulator to stay abreast of innovation in the online sphere?
What additional problems arise when online gambling companies are based outside UK jurisdiction?

After the publication of the White Paper, on 27 April 2023, the terms of reference were broadened to include:

What are the most welcome proposals in the Gambling White Paper?
Are there any significant gaps in the Government’s reforms?
What are the potential barriers to the Government and Gambling Commission delivering the White Paper’s main measure by summer 2024, the Government’s stated aim?

Culture Media and Sport, Chair, Dame Caroline Dinenage MP, said:

“While gambling regulation should not overly impinge on the freedom to enjoy what is a problem-free pastime for the majority, more should be done to shield both children and people who have experienced problem gambling from what often seems like a bombardment of advertising branding at football and other sporting events. The Government needs to go further than the proposals in the White Paper and work with sports governing bodies on cutting the sheer volume of betting adverts people are being exposed to.”

The Committee received more than 160 submissions and held four oral evidence sessions.

Main conclusions and recommendations:

Implementation of the Gambling White Paper

The Government must set out a detailed timetable for the delivery of the White Paper’s proposals, with the Committee concerned that there was no mention of gambling legislation in the King’s Speech.
The Government and Gambling Commission should set out how they will address the growing trend of unlicensed gambling sites targeting the self-excluded. The Gambling Commission must also continue to work to improve its knowledge of the black market and its ability to monitor the number of British consumers gambling with illegal operators.

Online gambling protections

The Committee supports the principle of financial risk checks, but they must be minimally intrusive with customers’ financial data properly protected. There should be a pilot of the new system before the checks are fully implemented.
Stake limits for online slots should match those for electronic gaming machines in land-based venues and not exceed £5. Online deposit limits should be set by default and require customers to opt out rather than opt in.

Children and young adults

The Government should review the case for banning children’s access to social casino games, which are often playable on smartphones and simulate gambling activities and products.
The Committee supports the proposed enhanced online gambling protections for young adults aged 18-24, namely triggering a financial risk check at a lower monetary loss threshold and limiting the stake for online slots to £2. The Government, Gambling Commission, and gambling operators must ensure these measures do not unintentionally lead to more adults in this age group giving a higher age at account-creation.

Gambling advertising

There is an urgent need to better understand the effects of gambling advertising on the risk of harm. The evidence for a link between advertising and gambling harm currently appears much stronger than evidence indicating there is a risk of displacement to the black market if gambling advertising were restricted. The Government must commission research on the link between gambling advertising and the risk of gambling harm, including specifically for women and children.
The Government should have taken a more precautionary approach to gambling advertising in general – particularly to minimise children’s exposure. While a complete ban on gambling advertising would not be appropriate, there is still scope for further regulation beyond that proposed by the Government.
The Government should work with the Premier League and the governing bodies of other sports to ensure that the gambling sponsorship code of conduct contains provision to reduce the volume of gambling adverts in stadia. A higher proportion of gambling advertising in stadia should be dedicated to safer gambling messaging. The Government must require sports governing bodies to publish the code without further undue delay.

Land-based gambling

Customers who prefer to pay on electronic gaming machines using cash should continue to be able to do so on all machines following any introduction of cashless payments.
The Government must ensure that the new settlement arising from the review of the Horserace Betting Levy mitigates the impact of the White Paper’s reforms on the racing industry and ensuring British racing’s future.

Gambling research, prevention and treatment

The Committee supports the proposed structure and governance of the new statutory levy to be imposed on operators in the industry to fund gambling research, prevention and treatment. The Government must ensure that service providers currently operating via the voluntary funding system are adequately supported in the transition to a statutory levy. There should be a new national strategy for reducing gambling harms.

A Gambling Ombudsman

The scope of the new gambling ombudsman should include all disputes between gambling operators and their customers, not only those relating to social responsibility failings.

Government has two months to respond.

Please get in touch if you would like discuss any of the proposals in the White Paper or would like any assistance preparing a response to the Gambling Commission’s current open consultations: the Autumn consultation, which includes proposals relating to incentives, customer-led tools, customer funds protection and regulatory returns reporting (closing 21 February 2024) and the December consultation on proposals relating to financial penalties and financial key event reporting (currently closing 15 March 2024).

20Dec

DCMS publishes Gambling Commission Framework Document

20th December 2023 Ting Fung 162

Further to its consideration of the Gambling Commission’s powers and resources in the White Paper, the Department for Culture, Media & Sport (“DCMS”) published the Gambling Commission Framework Document (the “Policy Paper”) on 11 December 2023.

The Policy Paper, which has been agreed between DCMS and the Gambling Commission and approved by HM Treasury, sets out the broad governance framework within which DCMS will work with the Gambling Commission to provide:

“an effective environment for the Commission to achieve its statutory objectives through the promotion of partnership and trust.”

The Policy Paper updates the previous version of the corporate governance framework, which was published on 29 October 2021.

What are the Gambling Commission’s statutory objectives?

As a reminder, the Gambling Commission’s key statutory duty, as set out in the Gambling Act 2005, is to permit gambling insofar as it thinks is reasonably consistent with the licensing objectives of:

a) preventing gambling from being a source of crime or disorder, being associated with crime or disorder or being used to support crime;

b) ensuring that gambling is conducted in a fair and open way; and

c) protecting children and other vulnerable people from being harmed or exploited by gambling.

In addition, the Gambling Commission is responsible for regulating the National Lottery by virtue of the National Lottery etc Act 1993. In this regard, the Gambling Commission’s objectives are to manage the National Lottery in a manner most likely to secure:

a) that the interests of all participants are protected;

b) that the Lottery is run with all due propriety; and

c) that, subject to the objectives above, returns to good causes are maximised.

What does the Policy Paper do?

The Policy Paper sets out the manner in which DCMS and the Gambling Commission will work together to provide an effective environment for the Gambling Commission to achieve its statutory objectives.

The Policy Paper “does not convey any legal powers or responsibilities”. Instead, it provides a framework of good corporate governance practice and applicable regulatory requirements and expectations that accords with principles set out in the Treasury’s handbook, Managing Public Money (“MPM”), and within which both parties have agreed to operate.

Broadly, this means that the Policy Paper sets out the Gambling Commission’s core responsibilities, describes the governance and accountability framework that applies between the roles of DCMS and the Gambling Commission, and sets out how the day-to-day relationship works in practice, including in relation to governance and financial matters.

What does the Policy Paper say?

Some of the more notable aspects of the Policy Paper include:

In accordance with MPM Annex 3.1 a requirement for the Gambling Commission to provide “an account of corporate governance in its annual governance statement” including an assessment of its compliance with the Corporate Governance in Central Government Departments Code of Good Practice, with explanations of any material departures.
A requirement for Gambling Commission officials to liaise regularly with officials in DCMS’ Gambling Commission sponsorship team, DCMS’ primary contact with the Gambling Commission, to review performance against plans, achievement against targets and expenditure. This relationship, in turn, is overseen by the Deputy Director for Gambling and Lotteries.
Annual submission by the Gambling Commission of a draft corporate plan considering the following key matters in the year ahead:
- key objectives and associated key performance targets for the forward years, and the strategy for achieving those objectives;
- key non-financial performance targets;
- a review of performance in the preceding financial year, together with comparable outturns for the previous 2-5 years, and an estimate of performance in the current year;
- alternative scenarios and an assessment of the risk factors that may significantly affect the execution of the plan but that cannot be accurately forecast; and
- other matters as agreed between the department and the Gambling Commission.
The first year of the corporate plan will form the basis of the Gambling Commission’s business plan, which shall then be updated annually regarding key targets and milestones for the year immediately ahead. DCMS will also use the draft corporate plan to allocate the Gambling Commission’s annual budget and send this to the Gambling Commission by May/June each year.
A requirement for the Gambling Commission to publish an annual report of its activities, with the draft submitted to DCMS at least two weeks before the proposed publication date. The annual report must:
- cover any corporate, subsidiary or joint ventures under the Gambling Commission’s control;
- comply with the Treasury’s Financial Reporting Manual; and
- outline the Gambling Commission’s main activities and performance during the previous financial year and summary form forward plans.
In addition, the annual report must include the Gambling Commission’s finalised (audited) accounts. However, these will need to be provided to DCMS by May/early June each year so that they may be consolidated within DCMS, laid in Parliament and made available on the Gambling Commission’s website.
Formal performance review by DCMS four times a year.
Annual meeting between the Responsible Gambling Minister and Gambling Commission Chair as well as annual review of the Chair’s performance by DCMS.
Annual meeting between the Principal Accounting Officer (the Permanent Secretary of the department) and Gambling Commission Chief Executive (who is also the Accounting Officer responsible for safeguarding public funds and ensuring that the Gambling Commission is being run according to the MPM standards regarding governance, decision making and financial management).
A requirement for the Gambling Commission to provide information to DCMS monthly (at a minimum) to enable DCMS to satisfactorily monitor the Gambling Commission, including but not limited to its cash management.
Internal audits to be conducted (according to the Public Sector Internal Audit Standards, as adopted by HM Treasury) and reviewed by DCMS’ sponsorship department.

In addition, the Gambling Commission’s agrees to comply with the guidance set out at Annex A of the Policy Paper in areas of corporate governance, financial management and reporting, management of risk, commercial management, public appointments, staff and remuneration, and other general guidance.

Gambling Commission Fees

Notably, in relation to Gambling Commission fees (a topic upon which DCMS is expected to consult next year), the Policy Paper confirms that review of Gambling Commission fees remains at the discretion of the Secretary of State, to be exercised in accordance with MPM principles. Nevertheless, the Policy Paper confirms that the:

“Gambling Commission and DCMS will carry out an annual health check to determine whether fee levels remain appropriate or whether a further comprehensive review is required”.

The annual health check will consider:

any significant changes to legislation or the number/complexity of regulated operators;
levels of inflation;
efficiency savings made by the Gambling Commission; and
whether changes to industry structures or patterns of risk have significantly altered the focus of the Gambling Commission’s regulatory effort.

DCMS can bring the annual health check forward or initiate a comprehensive review of fees if it is clear this is required. Otherwise, the outcome of the annual health check will be recorded and signed off by the Director of Finance or the Head of Gambling and Lotteries in DCMS and by the Chief Executive or Chief Operating Officer of the Gambling Commission.

Next steps

The Policy Paper confirms that it should be reviewed and updated at least triennially unless there are exceptional reasons. However it goes on to state that the latest date for the next review and update is 1 September 2025, just under two years from now.

Given the amount of work on both DCMS and the Gambling Commission’s respective “plates” at the moment – with many of the reforms in the White Paper yet to be implemented – DCMS and the Gambling Commission will likely be pleased that the Policy Paper has now been agreed and that they can both take positive steps to progress other matters.

Please let us know if you have any questions or wish to discuss.

For further details on the Policy Paper, see the DCMS’ website.

Uncategorised