The duty at the door
The Gambling Commission’s Licence Conditions and Codes of Practice require operators to have effective procedures to prevent underage gambling and to refuse customers who have self-excluded. In a busy venue, with a register that can run to thousands of photographs, relying on staff memory is not an effective procedure. Public tests have shown how often it fails.
Checking every face at the door is the only way to apply the duty consistently. That is why it has to be done lawfully.
Self-exclusion is a data system
A self-exclusion register is not just a list of names. It holds health-related data about people at risk of harm, and it is shared between businesses. Every failure at the door is therefore a licensing failure and a data protection failure at the same time. Operators who treat the register as data to be governed, rather than a folder behind the counter, are the ones best placed to defend themselves.
“A self-excluded customer at the door is someone to protect, not someone to catch.”
How we make it lawful
- The right legal footing. Legitimate interests as the Article 6 basis, the correct Article 9 condition, and an Appropriate Policy Document that holds up to scrutiny.
- A DPIA written for your venues. Based on your actual layout, staffing and customers rather than a vendor’s template.
- Data minimisation. Faces compared only against the register and the age check, with non-matches deleted immediately.
- Human oversight. No customer refused on an algorithm’s decision alone. Trained staff confirm every match.
- Transparency. Clear signage and privacy information, so customers know before they enter.
- Clear roles. Controller, processor and joint controller arrangements mapped across operators, scheme owners and suppliers.
- A protective response. Procedures that treat a self-excluder at the door with care and point them towards support.
Working with the sector
We work closely with the Gambling Business Group, which supports a common, sector-wide standard for facial recognition. We believe a single shared standard serves operators, customers and the regulator better than many private ones.
FRACT
A standard you can point to. FRACT gives operators a clear, published benchmark for lawful facial recognition, so they can show the Commission, the ICO and their customers what they do rather than simply asserting it.
