UKGC Used RIPA to Access Phone Records

Article Content

UKGC Obtained Call Data for Four Individuals Under RIPA

A Freedom of Information (FOI) disclosure has revealed that the UK Gambling Commission (UKGC) used powerful surveillance legislation to obtain the phone records of four individuals on a single occasion since the start of 2018.

The data, released following a request made on 3 August 2023, shows the regulator is willing to use significant investigatory powers, typically associated with law enforcement and intelligence agencies, to pursue its objectives.

What the Data Reveals

The request asked the Commission for details on its acquisition of 'communications data', such as Call Data Records (CDRs), from mobile phone providers. CDRs do not contain the content of calls or messages but provide metadata, including the numbers involved in a communication, the time, date, and duration. This information is a powerful tool for establishing links between individuals and mapping networks of activity.

According to the UKGC's response, it has:

• Requested communications data on one occasion since 1 January 2018.
• Targeted a total of four individual phone numbers in that single request.
• Used the Regulation of Investigatory Powers Act 2000 (RIPA) as the legal basis for 100% of the requests.
• Had 0% of its requests rejected by the telecoms provider, indicating the legal threshold for access was met.

Crucially, the FOI response also confirmed that the Commission has not purchased or otherwise received any anonymised bulk mobile phone data sets. This suggests the regulator's use of communications data is highly targeted at specific criminal or regulatory investigations, rather than for broad, population-level analysis.

Why This Matters for Consumers

The use of RIPA is significant. This Act governs the powers of public bodies to carry out surveillance and investigation and requires that any intrusion into a person's privacy is necessary and proportionate for a specific purpose, such as preventing or detecting crime. For the UKGC to use RIPA, it must be investigating serious misconduct that could constitute a criminal offence, such as illegal unlicensed gambling or complex cheating and match-fixing conspiracies.

While the use of such powers may raise privacy concerns, the data shows that they are used sparingly. Accessing the data of just four individuals over more than five years suggests this is a tool of last resort for the most serious cases, not a routine compliance measure.

For consumers, this demonstrates the depth of the UKGC's enforcement capabilities. It confirms the regulator has the ability to go beyond operator data and financial records to investigate illicit activity that harms the integrity of the British gambling market. The confirmation that the UKGC does not engage in purchasing 'big data' from mobile networks also provides reassurance that it is not conducting mass monitoring of consumers.