As subscribers to the Front Runner will know, we have been somewhat critical of the way in which the Gambling Commission has sought to update the Social Responsibility Code Provision (“SRCP”) regarding customer interaction and the associated remote customer interaction guidance (the “Guidance”). As it mandates its own licensees to do, we urge the Commission to reflect on the mistakes it made, extracts the necessary learnings and updates its own consultation processes.

As a reminder:

• The current version of the Guidance was issued in July 2019 and came into force in October 2019.
• This was supplemented in May 2020 by some additional COVID-inspired ‘emergency’ guidance upon which we previously expressed our views (and do so further below).
• On 3^rdNovember 2020 the Commission commenced a full consultation to update its approach to customer interaction. See our in-depth analysis here. Readers will recall that all the noise around that consultation revolved around the Commission’s attempts to install an approach to affordability that has somewhat softened in the face of a barrage of criticism from the industry and its customers.
• On 18^thJanuary 2021, in response to criticism that the initial consultation was not designed to elicit responses from the regular punter, the Commission published a further ‘short survey’ on customer interaction focussing on the vexed and complex issue of affordability, a sub-element of the overall concept of ‘harm’.
• On 14^thApril 2022 (more than a year later) the Commission announced its response, mandating a new requirement, SRCP 3.4.3, that would apply to remote operators only, and which was stated to take effect on 12^th September 2022.
• On 20^thJune 2022, the Commission published its new Guidance to accompany this new SRCP, which was also intended to come into effect on 12^th September 2022, synchronously with the SRCP itself.
• On 2^ndSeptember 2022, the Commission suddenly announced that part of the new SRCP 3.4.3 and the entirety of the new Guidance, would now not take effect on 12^th September 2022. The Commission’s press release suggested the regulator had acquiesced to the industry request for “an extension to the timeframe………. to conduct further consultation”. This delay led to real confusion as to what operators were actually required to do by 12^th September 2022, which led to our publishing a clarificatory blog piece to provide some assistance.
• As we explained, the Commission then commenced a “further consultation” on 23^rd November 2022, with responses due by 23^rd January 2023.

We have commented before on the changes the Commission are seeking to make (and would urge the reader to revisit our in-depth analysis here) but draw the reader’s attention to the following:

The Guidance as a living and breathing document

The Commission notes that its “understanding of gambling harms and how they manifest is constantly evolving” and “for the purposes of raising standards, protecting customer interests, and preventing harm to customers, we will update and re-issue guidance”.

The Commission has form here. The aforementioned supplement to the original Guidance, issued in May 2020 in response to COVID was, in our view ultra vires, as we have previously written.

In a speech given not long after we published that view, the-then CEO of the Gambling Commission said:

“I know that imposing those changes immediately was a departure from our normal approach. I read some of the articles from lawyers raising an eyebrow at our approach. But frankly, unprecedented times required all of us to act more swiftly, so I make no apology for what we did”.

Whilst we do not disagree with the Commission’s statement in the current consultation that “new guidance may be appropriate … where new evidence or risks emerge which may have a meaningful impact on how the outcomes can be met, or to reflect lessons learned from compliance and enforcement activity”, we would object in the strongest terms to the Commission, again, seeking to amend regulation by ignoring due statutory process – see further commentary below. To do so is damaging to the relationship between the regulator and the regulated and simply sows the seeds for future legal challenge where such regulation is cited in enforcement cases.

 Data protection issues

As previously discussed here, we felt there were significant issues with the UKGC’s proposed guidance on SRCP 3.4.3 (11) (“Requirement 11”).  The consultation proposes a sensible alternative to manually reviewing all automated processes set out in Requirement 11 – namely that customers are informed of the automated process and offered an opportunity to contest the process, and then a manual review will take place if a customer does inform an operator that it wishes to contest the automatic review process.

From a data protection perspective, the alternative approach appears to be an attempt to align Requirement 11 and Article 22 of the UK GDPR (automated decision-making and profiling) by removing human intervention and offering an objection mechanism.

However, the consultation still seems somewhat muddled on how data protection will lawfully interact with Requirement 11.

Where automated decisions and/or profiling are undertaken in respect of data subjects, and these produce a legal or similar substantial effect on the data subject, individuals will have the right to not be subject to such decisions / profiling save where it is necessary to comply with a legal obligation.  It remains unclear quite how this consultation interprets Article 22, but what remains true is that operators should be conducting data protection impact assessments as they consider how to comply with Requirement 11.

Consumer law issues

Aspects of the changes the Commission is making raise important consumer law issues:

• Requirement 10 obliges licensees to prevent the take-up of new bonus offers where “…strong indicators of harm” (crucially, not defined in the Guidance itself, but rather on a case-by-case basis within each operator’s processes) have been identified. Notwithstanding the complexities of determining what actually amounts to a “strong indicator,” this requires operators to consider how to ensure transparency through terms and conditions to give effect to this new provision.
• Requirement 3 states that individuals who have difficulty “accessing information because of poor literacy or numeracy skills, knowledge or dyslexia” may be treated as vulnerable. We question whether the Commission is genuinely suggesting that those with dyslexia are potentially unable to properly contract with an operator and whether the regulator has considered the likelihood of claimants being encouraged to construct claims on the basis that their dyslexia, or poor numeracy, mean they were unable to properly understand the terms and conditions on which they transacted with an operator.

See our commentary here.

The oddity of Requirement 10

Operators will be required to prevent marketing and new bonus offers where “strong indicators of harm” are present. As we have previously written:

• The Commission does not define what strong indicators of harm are. That assessment must now take account of a “specific range of indicators” (none of which are new) but must be “defined within the licensee’s processes”, leaving discretion to operators to determine when the risks presented by players means they should be stopped from gambling further.
• The Guidance has been described by the Commission as a “far more prescriptive” approach to regulating customer interaction and as a move away from the Commission’s favoured outcomes-based approach to regulation. However, its failure to define when limits should be applied (and with many examples representing “edge cases” only) means there will be significant variations between how sensitive operators’ processes are to risk and how much protection is actually afforded to British players.

With this in mind, it is notable that the implementation of Requirement 10 was postponed in September 2022 and will now come into force instead in February 2023. It is also notable that the issues underpinning Requirement 10 (i.e. prevention of marketing and new bonus offers) were never mentioned in the original consultation in November 2020. Its inclusion in the Guidance was always therefore procedurally questionable.

It is even more remarkable, therefore, that the Commission has stated that it “will consider the responses received in relation to this consultation before making a fresh decision on guidance on SR Code Provision 3.4.3”, but “irrespective of this consultation, requirement 10 of SR Code Provision 3.4.3 will come into force on 12 February 2023 in any event.”

The Commission should expect this to be raised by an operator if Requirement 10 is enforced against it. It is regrettable that the Commission chose to go through yet another consultation process relating to the Guidance but overtly chose to implement this additional regulatory requirement regardless of the responses it receives. This, surely, leaves the Commission open to further criticism that it is still selectively complying with its own legal obligations regarding its conduct of consultations.

How the Commission will use the Guidance in its casework

Perhaps the most notable aspect of the draft Guidance is its lack of regulatory clarity, despite its length. Much has been said by other commentators and in conversations we have had with our clients about what the impact of the Guidance will actually be.

The Commission states that “for compliance and enforcement purposes, we will expect licensees to demonstrate how their policies, procedures and practices meet the required outcomes. This can be through implementing relevant parts of the guidance or demonstrating how and why implementing alternative solutions equally meet the outcomes”.

This works, as an approach, when the outcomes are clear.  But the Guidance is riddled with references to potential “vulnerability”, and potential “harm” and also, without any apparent academic justification, extrapolates certain types of vulnerability to being considered markers of gambling harm.

The key challenge for operators will be their ability “to demonstrate how their policies, procedures and practices meet the required outcomes”. As with the Commission’s approach to assessing anti money-laundering/counter terrorist financing processes (as demonstrated by its inflexible and incredibly formulaic approach to AML risk assessments), one worries that tick-box regulation may pervade, with operators needing to be able to show how their internal governance processes identify risk/harm/vulnerability, how they address it and whether their approach meets the (somewhat esoteric) aim of “minimising the risk of customers experiencing harms associated with gambling”.

In this regard, paragraph 65 of the consultation particularly caught our eye, which says:

“The Commission does not require in SR Code Provision 3.4.3, or set out in the proposed guidance document that operators should assess all of their customers for vulnerability – requiring customers to provide information in order to assess any factors which may indicate that a customer is vulnerable to gambling-related harm is likely to be disproportionate to the risks and may have a disproportionate negative impact on persons with protected characteristics. Our requirements on vulnerability, and the proposed guidance associated with vulnerability, primarily focus on circumstances where operators should identify indicators of vulnerability from information available to them.”

Operators will need to be resolute when faced with hindsight-laden accusations that they did not act early enough in certain situations. We have seen too many examples in compliance assessments where Commission Officials claim that had an array of personal, financial information been obtained on registration from a customer, the operator would have been able to make informed decisions from the get-go, rather than recognising the validity in building a proportionate system based on risk-mitigation. The quote above recognises the risk-based nature of compliance and should be kept in operator’s back pocket if they receive criticism from the Commission that had they only asked for information before the apparent risk was identified then they may have avoided it altogether.

The extent to which the long-awaited White Paper has impact on, or indeed, enshrines, the Commission’s current thinking remains to be seen but, in reality, it seems highly probable that “harm” and “affordability” will remain areas where the Commission continue to drive the agenda. It can only be hoped that it will do so with greater clarity, consistency and objectivity.

The consultation can be accessed here and closes on 23 January 2023. We would urge operators to respond.