Betting and Gaming horizon scanning: UK regulatory roadmap: Autumn 2020 edition

As we reported in May, in response to the Covid-19 pandemic and lockdown, and based on its interpretation of data collected from operators and YouGov surveys, the Gambling Commission amended its guidance on customer interaction, without prior notice to operators, by introducing a number of additional Responsible Gambling measures to be implemented as soon as possible. The measures included reviews of all thresholds and triggers used to track vulnerability, review of time indicators to capture play in excess of one hour, continual monitoring to identify customers whose patterns or play, spend or behaviours change, conducting affordability assessments for individuals picked up by thresholds or triggers which indicate consumers experiencing harm, preventing reverse withdrawals and stopping bonus offers or promotions being made to customers displaying indicators of harm.

The Commission has continued to monitor the impact of lockdown and easing of lockdown on gambling behaviours, mostly recently publishing further data on gambling behaviour on 17 September. The data from July 2020 shows a slight month on month decline in customer spend, including in online slots, as well as a decline in slots sessions exceeding one hour, and an increase in customer interactions.  Despite this, the Commission’s view is that gambling behaviours continue to evolve and still justify the restrictions contained in its updated guidance to operators on customer interaction. The Commission also published a reminder in June on the impact of the coronavirus pandemic and the need for vigilance in the face of heightened money laundering and terrorist financing risks.

Operators will be watching with interest as data continues to be published on gambling behaviours. It remains to be seen how long the Commission will keep its additional guidance in force and whether revisions will be made or if certain elements of the guidance remain in force permanently (see section on Game Design below regarding reserve withdrawals).

As expected, the Gambling Commission launched its "Consultation on High Value Customers" on 19 June 2020 and it closed on 14 August 2020. In the Commission's view, the management and incentivisation of VIPs, or high value customers (HVCs), poses two key regulatory challenges: (a) HVCs are more heavily engaged gamblers (in terms of their gambling spend, the frequency with which they gamble, or both), with heavily engaged gamblers being at greater risk of gambling-related harm; and (b) the disproportionate financial value of HVCs to licensees means regulatory compliance can conflict with short-term commercial objectives.

VIP incentives were one of three key areas that the Commission challenged operators to tackle in October 2019 and it published a progress report on these areas in June 2020. Following the development of a draft code by GVC and the BGC, the Commission believes that, if implemented quickly, the measures in the code could address the challenges set with respect to VIPs. The key commitments contained in the new code include undertaking full customer assessments before offering any HVC incentives, rewards or special treatment. Licensees must maintain full audit trails relating to their HVC reward programme and identify a senior executive or board member accountable for how HVC schemes operate. Operator teams that offer HVC reward programmes are not to receive remuneration or bonuses based on an individual's loss and/or spend. HVC scheme access will be prohibited for 18-24 year olds and HVC reward programmes will be conducted with consistent, clear and transparent good practice to prevent gambling related harm.

The Commission's progress report calls for the additional protections set out in the code to be implemented as soon as possible, which the Commission believes is achievable given a number are based on existing regulatory requirements. While the Commission believes that tailored incentives and bonuses can continue to have a place in the industry, they need to be satisfied that they are being offered in a manner which is consistent with the licensing objectives.

The restriction on 18 to 24-year olds from inclusion in HVC schemes has already been agreed to by the BGC's members and the Commission expects the measures outlined in the BGC's code to be implemented within three months of its June report, i.e. by September 2020. Once the new code is in place, the Commission will measure their effectiveness through targeted compliance assessments and by monitoring the volume of enforcement casework related to HVC.

Meanwhile VIP/HVC schemes will be a key focus on the forthcoming Gambling Act review (see below).

Schrems II

As we reported in July 2020, the Schrems II decision has raised difficult questions regarding whether personal data can be lawfully transferred from the EU to the US. The Privacy Shield is no longer a valid basis for the transfer of data from the EU to the US. While the use of standard contractual clauses (SCCs) may still be valid, if supported by appropriate supplemental measures, there is uncertainty as to what supplemental measures would be sufficient. The European Data Protection Board has issued limited guidance on the steps which need to be taken to support the transfer of personal data to the US. The European Commission is discussing a possible replacement to the Privacy Shield with the U.S. Department of Commerce. In the meantime, privacy campaigners have filed complaints with European data regulators in respect of companies which share customer data with Google Analytics or Facebook Connect (on the basis that any such data is being transferred into the US). The Irish data regulator has issued a preliminary order requiring Facebook to stop transferring personal data to the US; Facebook has appealed, indicating that if the order is upheld, then it would stop operating its core FB app and Instagram in Europe.

Gambling companies will be closely following these developments, not least because the Schrems II ruling has implications for all data transfers outside the EU (other than to countries which currently benefit from an adequacy decision, such as Canada and Israel). Data transfers to the UK from the EU may be impacted after 31 December 2020, if the UK does not receive an adequacy decision from the EU prior to the end of the Brexit transition period.

Draft guidance on joint controllers

There have been a number of other recent developments relating to data protection. In September 2020 the EDPB published draft guidance on the concepts of controllers and processors for the purposes of GDPR. This touches on the circumstances in which parties will be deemed to be joint controllers. The guidance does retain the concept that parties may be independent controllers rather than joint controllers; however, it indicates that parties will be deemed to be joint controllers where either (a) they make common decisions regarding whether and how the processing takes place, or where (b) they make converging decisions regarding the purposes and essential means. Converging decisions are those where the decisions of the parties complement each other and are necessary for the processing to take place. An important criterion is that the processing would not be possible without both parties’ participation in the sense that the processing by each party is inseparable, i.e. inextricably linked. The consultation period on this draft guidance runs until 19 October 2020.

ICO guidance on AI and data protection

In July 2020 the ICO published guidance on AI and data protection. This builds on the ICO's previous guidance, and addresses the importance of preparing DPIAs, as well as the security risks posed by the use of AI (i.e. the risk that the large amounts of personal data required to train AI systems may be lost or misused; and the risk that software vulnerabilities arise from the introduction of new AI-related code and infrastructure).

General regulatory focus on vulnerable customers

In its Annual Report for 2019-20, the ICO briefly mentioned that it is involved in the UK Regulators’ Network’s work on how vulnerable people are protected across a range of sectors and services, and that the ICO had supported the Gambling Commission’s work on protecting vulnerable consumers in the gambling sector, ensuring that data protection was factored into new proposals. This reflects an increased focus on vulnerable consumers across a range of sectors (for example, the FCA published revised draft guidance on the fair treatment of vulnerable customers in July 2020, which guidance as to when it may be lawful to process special category data relating to vulnerable individuals).

EGBA code of conduct

The European Gaming and Betting Association (EBGA) has published a code of conduct designed to guide online gambling operators on their processing obligations under the General Data Protection Regulation (GDPR). The EGBA intends for this code to become an EU-approved code of conduct under Article 40 of GDPR, and the code has now been submitted to the Maltese data regulator as the first step towards receiving official EU approval. The EGBA Code aims not simply to be guidance or best practice for the industry, but a fully-fledged code of practice with a monitoring framework, accredited in accordance with Article 41 GDPR. For a more detailed look at the legal status and scope of the EGBA's code, see our June article, "The EGBA publishes code of conduct on data protection in online gambling". Although the EGBA Code has not yet received EU approval, it indicates a "direction of travel" for the sector, and gambling operators (whether EGBA members or not) would be well advised to carry out an internal review and ascertain whether they are already in compliance with the Code, and, where not, consider possible changes to how they run operationally.

One of the three areas which the Commission in October 2019 challenged operators to tackle was the use of Ad-Tech to protect children, young people and vulnerable adults online. The industry working group tackling this issue committed to various measures, including a common list of negative search terms and suppression websites and better and more consistent use of customer data to ensure ads are targeting away from vulnerable groups. The Commission's June progress report noted that these measures were enshrined in the Gambling Industry Code for Social Responsible Advertising and effective by July 2020. The BGC working group also established a permanent cross-industry Ad-tech Forum and committed to continue engagement with a wide range of stakeholders (including platforms) and work with the Commission to publish and promote consumer advice.

The June progress report also confirmed that the industry working group commitments would become part of the regulatory framework by being enshrined in the Gambling Industry Code for Socially Responsible Advertising.

The Commission intends to continue to monitor the evolution of ad-tech with its regulatory partners and the BGC working group. In particular, it will look to the inclusion of relevant questions for Annual Assurance Statements, requiring operators to demonstrate what they have done to better shield children, young people and vulnerable adults from exposure to online advertising. The Commission has also made clear that it intends to hold the BGC AdTech working group to its commitments on metrics and evaluation. 

The BGC has recently published the 6th edition of the Gambling Industry Code for Socially Responsible Advertising which comes into effect on 1 October 2020. Under ordinary code provision 5.1.8 licensees should follow the code and are expected to ensure that all relevant code provisions are followed by their affiliate marketers.

With regard to affiliates, the 6th edition of the code includes: (i) a requirement for all affiliates to be subject to due diligence and PEPs/sanctions checks and KYC checks wherever relevant; (ii) a requirement for affiliates to comply with all relevant regulatory and legislative requirements including CAP's guidance on ensuring advertisements are obviously identifiable as such. In order to promote consistency, the code states that all affiliate ads should be clearly and prominently marked as '#ad'; and (iii) a requirement for relevant affiliates to share safer gambling related content on a regular basis, with a frequency to be pre-determined with each individual operator with whom that affiliate has an agreement.  The terms on which operators deal with their affiliates should be updated accordingly.

The 6th edition of the code also seeks to address the proliferation of social media advertising and includes requirements that:

• Sponsored/paid-for social media advertisements may only be targeted at consumers aged 25+. This measure adds an additional level of assurance around the age of consumers where operators do not hold any first party data about the consumers targeted, (i.e. where operators are wholly reliant on self-certified third party data, which may not always be correct.) This requirement relates solely to prospecting campaigns where the targeted audience is not already verified through the operators own age verification processes. Given improvements in identification technology if a social media platform can verifiably prove that its age gating systems can prevent under 18s from accessing the gambling advertising content, then the BGC, on the recommendation of operators and in consultation with other third parties, may consider whether to reduce the age filter to 18+.
• Organic YouTube content produced by an operator and operators’ own YouTube channels must be age-restricted to 18+ to ensure users log in to age-verified accounts in order to view content. In the case of lotteries, the age gating required would be 16+ rather than 18+.
• Operators should undertake reasonable endeavours to exclude customers with an active self-exclusion or cool-off period and those who the operator has defined using its own method of assessment as a ‘higher risk’ customer, from its paid-for social media campaigns.
• Operators must use their own social media pages to post frequent safer gambling related information. It is expected that, in determining sufficient frequency, operators should take into account how active their own social media accounts are and act accordingly.
• Any search advertisements must clearly contain 18+ messaging in the ad copy, along with safer gambling messaging within the core ad format. In the case of lotteries, comparable 16+ messaging should appear.
• Operators incorporate the industry keyword blacklist into all relevant campaigns where applicable (including any affiliate marketing carried out on behalf of the operators) and ensure any revised blacklist is incorporated into relevant campaigns in a timely fashion.   The keyword blacklist is not currently publicly available: please speak to your usual contact at Mishcon for more details.

As we reported in our last regulatory roadmap, the Information Commissioner's Office (ICO) is required to issue a new statutory code of practice on direct marketing, giving practical guidance and best practice recommendations on compliance with the requirements of data protection legislation and PECR. A draft version was published in early January 2020 and the ICO stated that it expected to release the final version later in 2020.  It remains to be seen whether this timetable is achievable, given the disruption caused by Covid-19 and the end of the Brexit transition period.

The draft code addresses various forms of online advertising, including custom audiences and lookalike audiences, as well as profiling and data enrichment. The ICO also flagged the importance of transparency when profiling customers, and indicated that current online advertising techniques are 'highly likely' to trigger the need for a formal data protection impact assessment (DPIA).

The ICO's draft code indicates that consent is likely to be required in order to use custom audiences. When using lookalike audiences, the ICO has indicated that you are likely to be a joint controller alongside the social media platform (and therefore obliged to check whether the social media platform has provided appropriate transparency information to the individuals in question). The ICO has also indicated that if any customers have objected to their personal data being used for direct marketing purposes, then you cannot use their data for the purposes of building lookalike audiences.

In October 2019, the Commission also challenged operators to tackle game and product design by asking the industry to work together to consider "what responsible innovation looks like in terms of game design." The Commission's June progress report confirmed that the BGC was committed to publishing a code, based on work by two groups chaired by Scientific Games and Playtech, by 30 September 2020. The core elements being taken forward include a minimum spin speed of 2.5 seconds on all slots, removal of game features that speed up play and a prohibition on games that allow players to place multiple, different stakes on multiple slots games within a single gaming client.

The Commission's view is that the measures set out in the draft code represent "some initial tangible actions which are likely to move the debate on at least partially." The Commission used these commitments as the basis for its own LCCP consultation on online slots game design and reverse withdrawals, which closed on 3 September. The Commission has sought views on proposals to: reduce the intensity of online slots, improve the information available to consumers who play slots and prohibit reverse withdrawals.

The proposed measures would prevent operators from allowing customers to play more than one slots game through a single customer account at the same time, introduce speed of play limits, prohibit player-led "spin stop" features, prohibit auto-play functionality and prohibit effects that give the illusion of "false wins". Additional proposals would require operators to display the customer's net position during a gaming session and the elapsed time since the session started (regardless of whether the device clock is obscured or not). The proposals also include a permanent ban on reverse withdrawals for all consumers.

On 1 May 2020, the Commission launched a consultation on Regulatory Panel Reforms to ensure that the Commission's Regulatory Panels are best equipped to deal with the Commission's evolving casework.  The consultation has been launched in recognition of the fact that the cases heard by Regulatory Panels are becoming increasingly complex and legalistic. Under the proposals the Commission will employ between four and six legally qualified persons solely for the purposes of sitting on Regulatory Panels (known as "Adjudicators").

The consultation document itself is relatively innocuous. However, there are some noteworthy proposed amendments to the Commission's procedures and guidance for licensing and regulatory hearings. In particular, agreed form document bundles will now be required to be submitted to the Panel no later than 21 days prior to the hearing (previously seven days) or if the bundle is not agreed, the applicant must submit their own bundle no later than 14 days prior to the hearing. If the proposed changes come into effect, applicants will be given a choice of three hearing dates over a two-month period and are expected to be flexible as to the hearing date (dates will not be changed unless it can be demonstrated that there is good reason why none of the proposed dates are workable). There is also a proposed extension to the time period within which financial penalties should be paid (from 14 days to 30 days).

The Commission has consulted on changes to its regulatory data reporting requirements, seeking to make them more efficient for both licensees and the Commission. The Commission described its proposals as seeking to: improve data quality and the efficiency of regulation; reflect its continued focus on consumers and social responsibility; ensure requirements are reconciled against its current and future data needs; streamline its existing requirements and, where possible, reduce regulatory burden.

The changes to the LCCP resulting from the consultation and set out in a response document published on 30 July 2020 will take effect on 31 October 2020. Some of the changes go towards reducing regulatory burden, for example the removal of the requirement for operators to report nominated persons to the Commission. Other changes reinforce the principle that responsibility for meeting the licence conditions rests with licensees, not third parties. In licence condition 15.1.2 (Reporting suspicion of offences etc.), for example, the wording is revised to make clear that licensees must provide the Commission (not "or ensure the Commission is provided with") information relating to suspected offences.

Following consultation, the Panel has amended the licence condition relating to remote key equipment. As of 29 July 2020, the Commission no longer requires remote operators to: (a) make an application to vary the licence prior to adding key equipment or relocating any equipment from the jurisdiction originally stated when the application for a licence was made; or (b) submit a key event to inform the Commission if they move remote key equipment within a jurisdiction.

Explaining the rationale for the changes, the Commission explained that over time it has become apparent that physical inspection of key equipment is not necessary as it is the data held on the equipment that is required. The Commission retains the ability to request the data via licence condition 2.1.2. In an "outcome focussed regulatory environment", the Commission will look initially for assurance rather than undertaking physical checks and therefore do not need to know the number of pieces of key equipment or where they are located.  

The Government committed in its manifesto to review the Gambling Act 2005 to make it fit for the digital age.

On 1 September 2020 Nigel Huddleston, Secretary of State for Digital, Culture, Media and Sport, indicated that a call for evidence to inform next steps around loot boxes is expected to launch "shortly" and that further details regarding the review of the Gambling Act would be announced in "due course". Rumour has it that there may be some progress during October 2020…

Whilst we await the announcement, speculation as to the scope of the review continues to grow and various interested parties have publicised their views, expectations, suggestions and recommendations. The most recent report by the Social Market Foundation, a foundation whose main activity is the commission and publication of original papers by independent academics and other experts on key topics in the economic and social fields, with a view to stimulating public discussion, makes for an interesting read.

The report puts forward a series of policy recommendations ahead of the anticipated review of the Gambling Act and proposes a new framework for reform. The report examines five main topics:

• Gambling licences: the report advocates : the introduction of a mandatory kitemark for all licensed operators (which would be withdrawn if the operator breached the LCCP although it is not clear who would determine if a breach has occurred or if breaches of ordinary code provisions would result in withdrawal); the abolition of 'white label' arrangements; the introduction of a transparent system of regulatory sanctions; and the introduction of personal functional licences in the remote sector for key account managers and VIP managers with a burden of responsibility for adhering to the LCCP placed on these roles. The report goes on to call for a full audit of all existing licensed remote gambling operators to properly assess their suitability in terms of ownership, business structure and source of wealth.
• Gambling content: the report recommends the introduction of: a new categorisation of remote gambling content from slots and casino games to social gaming, video gaming and other types of emerging products; stake limits for online slots of between £1 and £5 and limitations on non-slots content by reference to the speed, frequency and nature of the product.
• Gambling affordability: the report suggests a working definition and model of multi-operator affordability based on an analysis of income and living standards (overseen by a new Gambling Ombudsman) and the introductions on a 'soft cap' limit of £100 per month on net deposits.
• Gambling tax: the report calls for a review of all gambling taxation and an assessment of potential changes to the application of gambling duty by reference to the onshore 'footprint' of the operator (including capital, human, social, legal and digital presence in the UK) and incentives for establishing activities onshore.
• Regulatory framework for gambling: the report recommends a reorganisation of Government oversight, replacing the existing arrangement with a  new cross-departmental ‘Gambling Quartet’ consisting of: a Gambling Licensing Authority (to replace the Gambling Commission), under the sponsorship of the Ministry of Justice; a new Gambling Ombudsman, under the sponsorship of the Department for Business, Energy and Industrial Strategy; the funding and commissioning of Research, Education and Treatment channelled via a statutory levy through the NHS and UK Research Councils, under the sponsorship of the Department of Health and Social Care; and the oversight of advertising, the Lottery, and sporting and cultural events relating to gambling retained under the sponsorship of the Department for Digital, Culture, Media and Sport.

Meanwhile, a group of 150 cross-party member of the House of Lords has established the group "Peers for Gambling Reform" and will promote the findings published in a report of the House of Lords Select Committee into gambling, which include a statutory duty of care, affordability checks, stake limits for online gambling and enhanced testing for gambling-related harm.