Changes to Data Protection laws
On 25 May 2018 the law will change about processing personal data as the Data Protection Act 2018 and the EU General Data Protection Regulation (‘GDPR’) come into effect. This will affect all areas of any business that process personal data including data about staff, customers, suppliers and website users.
Concerns have been expressed to the Gambling Commission that GDPR will affect what steps can be taken to tackle issues such as problem gambling, and gambling-associated crime. In response the Gambling Commission has issued a guidance note, a copy of which can be found here.
Lawful grounds for processing data
The Gambling Commission says it has been working closely with the ICO to make sure that the way in which Operators interpret and implement GDPR does not conflict with the requirements of gambling regulation. GDPR lists six lawful grounds for processing data:-
- With consent of the data subject
- For the performance of a contract
- For compliance with a legal obligation
- To protect the vital interests of the data subject
- It is in the public interest
- It is necessary for the purposes of the legitimate interests of the data controller or a third party provided this is not overridden by the interests and fundamental rights of the data subject.
The Gambling Commission suggests that where it is not practical to obtain consent, and in order to ensure that public policy objectives such as the reduction of problem gambling are met all the other grounds may be applicable to various situations. In particular a data subject who has self excluded will not be entitled to have their personal data removed from a self exclusion scheme as it would be lawfully held under grounds 3, 4 & 5.
Further help on GDPR
A useful guide produced by the ICO on GDPR as to what is fact and what is fiction is available on the ICO website
For further advice and guidance on GDPR call us on 07854149504