Evaluation of the Gambling Act Review Diary Studies: Privacy Notice

Who are NatCen?

The National Centre for Social Research (NatCen) is an independent, not-for-profit social research organisation. You can find a link to our website here: https://natcen.ac.uk/.

What is this research about?

This privacy notice sets out how your information will be used for the evaluation of the Gambling Act Review (GAR). The White Paper and the GAR proposed several changes to policies related to gambling. NatCen has been commissioned by the Department for Culture, Media and Sport (DCMS) and the Gambling Commission (GC) to conduct an evaluation of the GAR. The focus of the evaluation is to gather evidence to evaluate and better understand changes to gambling related policy, including how these changes are being implemented, whether they are being delivered effectively and are achieving their intended outcomes, and the impacts that they have. NatCen will also capture learning to inform effective future policy changes.

The evaluation will involve several work strands including quantitative and qualitative data collection and analysis and surveys with different groups of people. As part of the qualitative work strand, we are conducting diary studies with people aged between 18 to 24 to gather more evidence related to policies focused on online gambling, land-based gambling, and gambling marketing and advertising.

What is the legal basis for processing my data?

For the purpose of data protection legislation, DCMS and the GC are joint data controllers and NatCen is the data processor. This means that DCMS and the GC are responsible for deciding the purpose and legal basis for processing data collected in relation to the GAR data collection activities. In order to use personal data in a manner which is lawful, we need to meet one (or more) conditions in data protection legislation, as set out in Article 6(1) of the General Data Protection Regulation (GDPR). As such, the lawful basis for this data processing will be ‘legitimate interest’. This is because we believe that there is a genuine reason for us to process this data (to evaluate the GAR), this data is needed to fulfil this purpose (we could not evaluate without this information), and that using this data will not interfere with individuals’ interests, rights or freedoms. Furthermore, we will be collecting special category data (information relating to ethnicity and health) and therefore also need to meet one (or more) conditions in Article 9(2) of the UK GDPR. For the diary studies, the legal basis for the processing of special category data is ‘explicit consent’. This means that if you decide to take part, we will ask for those participating to expressly say that they consent to participate and provide this information or withdraw their consent to participate. Throughout the diary studies, participants also have the option of declining to answer questions, including those about ethnicity and health.

Who will have access to my personal data?

We are recruiting people to take part in the diary studies to collect data for the evaluation. This will involve the processing of personal data of those participating in the research. Named individuals in the NatCen research team will have access to the contact details of those taking part. This is for the purpose of organising and facilitating the diary studies.

No one at NatCen outside of the designated research team will have access to the data; this will be stored in secure folders which have restricted access.

The evaluation has been commissioned by DCMS and GC and any outputs (an interim report, a main report, and technical report) will be published by these organisations. As they are the data controllers, they will have access to data which we collect during the diary studies which has been anonymised so that it is not possible to identify who participated. If you ask for your data to be altered (please see the ‘Do I have the right to withdraw my data?’ section below for more information) this alteration will be made in the data that DCMS and GC have access to. They will store this for a period of up to five years.

How will my data be used?

The data we collect will be used for research purposes only. Information gathered from the data collection activities, including the diary studies, will feed into evidence as part of the evaluation to understand the implementation and impact of the policy changes.

We will treat everything you say as confidential; we will not inform anyone that you have participated or what information you have provided as part of the diary studies. Data which is accessible by DCMS and GC will have identifying details (such as your name) removed. The only exception to your participation being confidential is if you share information with us that suggests that either you or someone else are at imminent and serious risk of harm. We would always try to discuss this with you first. For more information on this, please refer to our disclosure policy.

During the study, NatCen will store and manage all data securely and confidentially. The data collected during the diary studies and all other data collection methods will be used to write an interim report, the purpose of which is to understand emerging findings and further inform the evaluation (this will not be published), a final report, and a technical report, which details the methods which we have used. We may also present the findings of the evaluation to relevant parties, such as at conferences. All outputs generated by NatCen for DCMS and the GC which use or are informed by data collected from the diary studies will not identify any of your responses or personal details. All personal information, and any other data held, will be securely deleted five years after the evaluation is completed. This is expected to be in 2026 and NatCen/DCMS/GC intend to hold your data until 2031. You will receive a further privacy notice for all further data processing activities which involves your data to explain the purpose of this.

Do I have the right to withdraw permission?

You have the right to withdraw your permission for data processing and ask for your contributions to be redacted or withdrawn entirely at any point. You do not have to justify or explain why you wish to do so. If you do decide to withdraw your permission, we will stop processing your data and remove the data that you have provided. However, if you wish to withdraw your consent after your participation, your data will be combined with other responses as part of analysis. During this process, your data will be anonymised (your name and identifiable details will be removed) and combined with the data provided by other participants to understand the themes and patterns in the responses, and data which you have provided will not be identifiable. Because of this, it will not be possible to withdraw or redact data following this analysis. Therefore, you can withdraw your permission up to the point at which analysis has started. The date of this for each wave of the diary studies will provided to you before you provide any responses. After this time, you are able to withdraw your permission for your data to be processed for further activities, and we will remove your data from that which is stored (as outlined in the above section).

If you do decide to participate in the diary studies, and then later wish to withdraw your permission to take part, you can contact the research team by emailing GARevaluation@natcen.ac.uk. 

What are my rights as a data subject?

Under UK GDPR, people whose personal data is being processed have certain rights. Data subjects have the right to be informed about the collection and use of personal data; information about this in relation to the GAR diary studies is outlined in this privacy notice. In addition, as a data subject, you have the following rights:

• You are able to access personal data which is held by NatCen in relation to this research, in a format which is easy to transfer;
• If NatCen hold data which is not accurate, you have the right to correct this and for inaccuracies to be rectified;
• You are able to withdraw your permission, object to your data being processed, and have your data erased (please refer to the above section for further information);
• Under certain circumstances, you are able to restrict the processing of your data (please refer to the above section for further information); and
• You can make a complaint relating to the processing of your data (please refer to the below section for further information).

Who can I contact with a query or complaint?

If you have any questions about how your data will be used for this research, or the evaluation in general, please contact the research team at GARevaluation@natcen.ac.uk.

If you have any concerns over how your data is used, you can contact NatCen’s Data Protection Officer at dpo@natcen.ac.uk.

Under UK GDPR, you have the right to lodge a complaint about how information has been used or managed with the Information Commissioner’s Office. Please go to www.ico.org.uk for more information.