Is this over-sharing? Feels like it to me…

I’ve been looking a lot at the requirements of the in-coming gambling legislation and there’s one part of it that has me scratching my head more than any other.

It relates to the sharing of information with third parties, which was a subject I once spent a great deal of time looking at when we (at Betfair) put together the Memorandum of Understanding that allowed us to give data to sports governing bodies. I remember the significant number of hoops we had to jump through, in order to ensure that the whole framework that we were putting in place did not fall down in legal terms. Looking at current plans, I am trying to work out what must have changed for the Gambling Commission not to be heading for a legal minefield that it hasn’t spotted.

The licence application process under the new legislation requires an applicant to disclose a considerable amount of information to the Gambling Commission, and the Commission is clearly of the view that it has the power to share information with overseas regulators.  I know that not because I have asked them, but because they have stated so publicly on at least three occasions.

The first of those was in the Statement of Principles for Licensing and Regulation published in September 2009, where it says that:

The Commission will seek to build and maintain good liaison and working relationships with local authorities, other regulators and law enforcement agencies and other regulators to share relevant information and, where appropriate, investigate offences. (Paragraph 4.11, p.10)

Things aren’t entirely clear here: perhaps ‘other regulators’ appears twice in order to emphasize that it covers overseas regulators (on the basis that ‘local’ relates not just to ‘authorities’, as I would read it, but to the three things that follow it). Who knows? It also isn’t clear exactly what information would be shared, nor how you determine ‘relevance’, nor whether the information can be shared proactively or reactively (which I seem to remember was a major issue when it came to our MOU process). And it seems at least possible that the wording as phrased could result in the sort of fishing expedition that we were always told it was essential to prevent, in order to ensure that the rules were not open to a challenge. But in a way, who cares? To my knowledge no challenge has been made to date, and it’s been sitting out there for five years without anyone saying boo.

The trouble is that we are now entering a period where a new load of licencees will be scrutinising this stuff, which probably explains why the Commission has set about trying to clarify it. A consultation document of proposed amendments to that initial document, published in July, is much more defined. It says that the Commission intends to add:

an explicit statement that the Commission will share information with other bodies, where appropriate. This may include for example sharing data with relevant public authorities, overseas regulators for the assessment of individuals’ suitability to be licensed, the prevention and detection of crime for the purpose of assisting another body to exercise its functions.

Not much doubt here, then, that the Commission sees itself as empowered to share information that it receives with overseas regulators, who are now specifically mentioned.  That ability to share is still limited to where ‘it is appropriate’ to do so, and two circumstances are given as examples to try to give greater clarity as to what that means. They seem perfectly sensible to me: to assess an individual’s suitability to be licensed; and to prevent and detect crime. We still don’t know what information that might be, though; and the implication that the Commission will share it proactively seems to my ailing memory to put it into a very grey area of the law. But then there is further clarity still, because a huge disclaimer in the Jurisdictional Rider in its application form appears to give the Commission carte blanche. That reads:

The information provided in this application will be processed for the purposes necessary for the Gambling Commission to carry out its functions and meet its legal obligations.  The data may be shared with third parties who fulfil a service on behalf of, and under the express instructions of, the Gambling Commission. It may also be shared with other bodies where it is necessary to do so and where we are legally required or permitted to do so. This may include sharing data, when appropriate, with relevant public authorities, overseas regulators, law enforcement agencies.  Sharing data is primarily for the purpose of performing our regulatory functions such as assessing individuals’ suitability to be licensed but it may also be necessary to share information for the prevention and detection of crime or for the collection of tax and gaming duty … We will treat all information as confidential and will only disclose that information to third parties where it is necessary to do so in order to carry out our functions or where we are required by law to disclose the information.” (p.22).

So that would appear to be that. Except that the ability to share information with third parties laid out in this disclaimer is dependent on the Commission being legally required or permitted to do so, as one might expect. And suddenly, as a result, the whole thing is, it seems to me, thrown very much into doubt. Because it surely means that what needs to be considered is none of the three statements quoted above: not the Statement of Principles for Licensing and Regulation; nor the consultation document; nor the Jurisdictional Rider. What matters, surely, is what it says in the Gambling Act 2005.

Now, I stress (as if you didn’t know it) that I am not a lawyer. But it seems to me that two sections of that Act are relevant. The first of those is Section 30, which provides the following:

(1) The Commission may provide information received by it in the exercise of its functions to any of the persons or bodies listed in Schedule 6—

(a) for use in the exercise of the person’s or body’s functions, or

(b) for the purpose of a function of the Commission.

My layman’s read of that tells me that this means that the Commission is not compelled to share information with any of the persons or bodies that are listed in Schedule 6, but that it can if doing so helps it, or the someone or some group it shares with, do a better job. This in turn means requiring that the Commission satisfy itself that the information needs to be shared for some regulatory function. So far so good.

But then Schedule 6 duly lists everyone relevant to this clause. And what is clearly intended to be an exhaustive list (as is evident from the fact that it was (I think temporarily) amended to include the IOC with the London Olympics Act 2006) does not include a single overseas regulator. Here’s the list taken directly from the Gambling Act 2005:

SCHEDULE 6 Exchange of Information: Persons and Bodies

Part 1: Persons and Bodies with Functions under this Act

A constable or police force
An enforcement officer
A licensing authority
Her Majesty’s Commissioners of Customs and Excise
The Gambling Appeal Tribunal
The National Lottery Commission
The Secretary of State
The Scottish Ministers
 

Part 2: Enforcement and Regulatory Bodies

The Director and staff of the Assets Recovery Agency
The Charity Commission
The Financial Services Authority
The Director General and staff of the National Crime Squad
The Director General and staff of the National Criminal Intelligence Service
The Occupational Pensions Regulatory Authority
The Office of Fair Trading
The Serious Fraud Office

 

Part 3 Sport Governing Bodies

The England and Wales Cricket Board Limited
The Football Association Limited
The Football Association of Wales Limited
The Horseracing Regulatory Authority
The Lawn Tennis Association
The Irish Football Association Limited
The Jockey Club
The National Greyhound Racing Club Limited
The Professional Golfers’ Association Limited
The Rugby Football League
The Rugby Football Union
The Scottish Rugby Union
The Scottish Football Association Limited
UK Athletics Limited
The Welsh Rugby Union Limited

In fact, what is noticeable about this list is that every name on it is that of a UK statutory body or person.  It seems fairly clear that as regards providing a legal basis for supporting recent Commission statements, subsection 30(1), well… it doesn’t.

The other relevant section seems to be Subsection 30(4). This one provides that:

(4) The Commission may provide information received by it in the exercise of its functions to a person if the provision is for the purpose of—

(a) a criminal investigation (whether in the United Kingdom or elsewhere), or

(b) criminal proceedings (whether in the United Kingdom or elsewhere).

OK: so again, at a quick read, this one helps. It seems to empower the Commission to share information with overseas statutory persons. But… It seems to be about overseas law enforcement agencies or prosecuting bodies more than it does about regulators looking at issuing licences; it also seems to necessitate that information-sharing being for the purpose of an overseas criminal investigation or overseas criminal proceedings, which will surely have an impact on what information can be shared; or alternatively it seems to require that a criminal investigation is taking place. What is does not appear to do it support the proactive sharing of information in relation to a licence application.

In short, the legal basis found in the Gambling Act, which the Commission appears to be assuming allows it to share information with overseas regulators, seems to me to be nowhere near as far-reaching as the Commission suggests in all three of the current version of its Statement of Principles for Licensing and Regulation, its consultation document, and its Jurisdictional Rider. Those three documents, it seems to me, imply that if I applied for a licence (and maybe was even turned down for one), and in a year or so Russia set up a Gambling Commission and I applied to it for a licence in turn, the Gambling Commission would consider itself to have the right to share with the Russians any information I had put in my form.

All of which is a very long story, I admit, and possibly a very tall one. I am not suggesting that the Commission has malevolent aims in its data-sharing plans – far from it. Indeed, I can see what it is trying to do, and why – which may lead you to ask why on earth I care, and why I have spent ages writing this blog… As a paid-up member of the ‘Less Bothered about Surveillance’ Club, I can see your point.

The answer is that I spend a lot of time having people tell me their worries about whether the new regime will work in a way that reinforces, rather than undermines, its intentions. And it seems to me perverse that in 2005 it was deemed necessary to list by name both the FA and the LTA, on the basis that ‘Sports Governing Bodies’ didn’t cut it, and at the same time be absolute prescriptive about the circumstances under which information can be shared; and yet in 2014 (when those applying for licences are likely to be far jumpier about data sharing than was previously the case) it is somehow fine to talk blithely about ‘overseas regulators’ and be vague about what might be shared, as if it isn’t going to give prospective applicants the heebie-jeebies in a way that will result either in obfuscation, or in persuading them not apply at all.

Perhaps I very much misunderstand the position. But assuming I haven’t (in which case I’d be grateful to know why), then it seems to me on that basis that at the very least, the explicit list of organisations with whom the Commission can share information is going to have to be expanded, and the basis on which it will decide the relevance of what it will share (perhaps even what it will share) will need to be significantly clarified.

I can see that that is really boring, and it will result in yet more work for an organisation that probably has it coming out of its ears. But just as, when we did the MOU, we knew that unless it was watertight, we would scare off half our customers, so is it true here that without tighter rules and better clarity, some applicants will not be given the comfort of privacy that they will see as important.

And the significant danger of that would be that the introduction of the new regime is considerably less likely to be a success.