Data Protection Bill [HL]

Written evidence submitted by the Association for UK Interactive Entertainment (DPB49)


The Association for UK Interactive Entertainment ( Ukie ) welcomes the opportunity to provide a submission to the House of Commons Public Bill Committee on the Data Protection Bill. We firmly believe that effective, modern data protection laws with robust safeguards are central to securing the public’s trust and confidence in our increasingly digital economy and society. The games and interactive entertainment industry therefore supports the Bill as a way of both ensuring the UK’s data protection laws are fit for the digital age, and to put the UK in the best possible position to agree a data adequacy agreement with the EU. In our submission we would like to highlight:

- The importance of data, and data regulations, in driving innovation in the UK games industry

- The steps our industry takes to ensure children and their data are meaningfully protected

- The importance of keeping this Bill narrow to ensure that the UK is in the best possible position to secure a successful Brexit which allows for the continued free flow of data between the UK and EU

About Ukie

Ukie is the trade body for the UK's games and interactive entertainment industry. It represents games businesses of all sizes from small start-ups to large multinational developers, publishers and service companies, working across online, mobile, console, PC, esports , VR and AR.

We aim to support, grow, and promote member businesses and the wider UK games and interactive entertainment industry by optimising the economic, cultural, political, and social environment needed for UK businesses to thrive.

We remain at the Public Bill Committee’s disposal to elaborate on any of the points made in our submission .

How d ata drives i nnovation in the UK games industry

With 95% [1] of UK games businesses exporting at least some of their products overseas, the UK games industry generates over £2bn [2] of global sales and is well placed to take a greater share of what is now $100bn [3] worldwide market , and will have grown by a fifth by the time the UK leaves the EU.

Blending technological innovation with imagination and design, we are a growing part of the UK’s creative industries sector; one of the six economic sectors noted by the Government to be of particular strategic importance in the negotiations as we leave the EU and in the post-Brexit environment. Whether it is in AI, data analytics or virtual reality, we put into practice and develop some of the innovations that can and will be increasingly applied elsewhere in the economy to boost productivity.

The UK’s over 2,000 [4] and growing games companies are spread right across England, Scotland, Wales and Northern Ireland with economic clusters including Leamington, Sheffield, Dundee and Cardiff (Nesta research showed 12 established and 6 emerging games clusters around the UK in all). Two-thirds of these companies were founded after 2010. 12,100 people are directly employed by the industry, most as developers; with the industry in all supporting the jobs of 23,900 people. [5] While most games companies employ under 10 people, the UK is also host to a high number of international and European HQs, such as those of Microsoft, Sony and Nintendo.

The games industry was born digital and relies on a strong digital backbone to continuously deliver the best products and services to global audiences. The interaction and associated data flows between games, players and games platforms is intrinsic to the proper operation of games, and the provision of fair, safe , and ethical interactive experiences for players.

Our ability to collect and use data to develop new business models and most importantly enhance players’ experiences significantly contributes to the innovation which distinguishes us from other creative sectors and has supercharged growth in our industry over the past 5 years.

The games industry continues to push the boundaries of interactive entertainment to offer the best possible games experiences for our consumers by using data to :

Create and share user generated games content

Create compelling multi-player experiences

Build and manage massive multiplayer communities

Understand players’ experiences and iterate future releases

Dynamically adjust game difficulty

Due to the crucial role data plays in the games industry, the Data Protection Bill and the EU General Data Protection Regulation (GDPR) will significantly shape the success of games businesses at home and abroad.

The steps the games industry take s to protect children and their data

We believe fairness and compliance with the data protection principles should be central to all processing activities of children’s personal data. The games and interactive entertainment industry strongly supports the approach taken in the GDPR that children need specific protections when their personal data are collected and processed because they may be less aware of the risks involved. We have, therefore, undertaken numerous efforts to promote parental involvement, protect children’s privacy, and to create safer environments for children, both online and offline.

We demonstrated this through the creation of the PEGI age-rating system (as acknowledged in the UK Government’s recent Internet Safety Strategy Green Paper) and its adoption on a pan-European basis with the support of the European Commission. Ukie led the successful campaign for PEGI’s adoption into UK law and continuously promotes safe and sensible game playing to parents, particularly through - a site providing information about age ratings, parental controls, in-games purchases and many other issues. Additionally, in 2013, we worked closely with the then Office of Fair Trading to shape a set of Principles for Online and App based Games to ensure consumers – especially children – were not subjected to practices that were misleading, aggressive, or unfair.

Moreover, the video games industry’s robust parental control tools are the most sophisticated in the entertainment sector. These not only allow parents to control access to game content based on their child’s age and maturity but also to manage and control how their children access the internet, share their data, and interact with others online.

Our sector has always been extremely vigilant about protecting children’s’ interest when new products and services are release d, in relation to the Data Protection Bill we consider that:

- Clause 124: Age-appropriate design guidance (rather than a binding code of practice) is a sensible compromise to concerns expressed in the House of Lords about processing children’s data while maintaining compliance with GDPR

- Due to the significant differences in the way online services operate we believe it would be more appropriate for the ICO to issue guidance - rather than a code of practice - on age-appropriate design

- This guidance created by the ICO should complement the work currently being undertaken between Government and industry to tackle concerns around child online safety, such as through the Internet Safety Strategy – which provides a more flexible approach to tackle broader issues of online safety concerns

- This approach would avoid any potentially negative impacts on GDPR implementation and UK-EU adequacy agreements

A narrow Bill will help ensure data adequacy with the EU

As UK games businesses export their products and services to a global audience, we inevitably rely on the ability to move data across national b orders. According to a recent Uk ie games industry survey, 59% of respondent games businesses rely on the ability to process data from users located outside the UK to service players and create new games . [6]

I t is therefore vital to us, along with the wider technology and creative industries, that the frictionless flow of data between the UK and EU is maintained and that the UK Government continues to proactively contribute to regulatory developments in this field and helps set the international agenda. I mplementing GDPR in order to have the same framework as the EU27 is an important first step.

Considering that this Bill is highly time sensitive , we believe that it should remain narrow with a clear focus on legislating for the derogations under the GDPR , and avoid ing any harmful regulatory divergences that could undermine the UK’s chances of gaining a mutual adequacy agreement with the EU.

We strongly welcome the Prime Minister’s recent commitment on ensuring the UK maintains strong levels of data protection and goes beyond an adequacy agreement to allow our Information Commissioner to continue to play a role in shaping future data protection rules. [7] However, more detail is needed on how the Government intends to secure a bespoke data agreement with the EU, and work needs to begin in earnest on securing this as well as adequacy agreements with third countries:

- Transitional arrangements may be required to avoid a cliff-edge as we will lose the automatic ability to transfer data between the UK and EU27 when the UK exits the EU

- As the House of Lords EU Home Affairs Sub-Committee recently concluded, securing an adequacy agreement offers the most robust and least burdensome way of retaining data flows with the EU. [8] This is also the most suitable mechanism for SMEs – that make up over 70% of the UK games industry - who would find transferring data difficult without adequacy

- Post-Brexit, the UK Government will also need to determine the adequacy of third countries, including the EU and the US before allowing the free flow of personal data to those countries. The process of establishing mutual adequacy with the EU, as well as recognising existing EU adequacy decisions with countries such as the US and

Canada must begin now, and the Government should set out the work it is conducting in this area.

March 2018

[1] TIGA, 2012

[2] TIGA, 2014

[3] Newzoo, 2014

[4] Ukie UK Games Map0, 2016

[5] BFI, 2015


[7] Our Future Partnership – speech by Prime Minister Theresa May, 2 March 2018



Prepared 20th March 2018