DATA PROTECTION IN UK GAMBLING
During a two-year period running from early 2017 to the end of 2018, SBG placed cookies on RTM's devices, processed his personal data, and sent him targeted direct marketing communications. RTM later sued SBG, contending that he had been a gambling addict during that period; that SBG's activities in placing cookies, processing his data and sending direct marketing were all unlawful because he had not given his consent; and that these activities caused him to gamble more and lose more than he otherwise would have, resulting in financial loss and distress. At a five-day liability trial in November 2024, Mrs Justice Collins Rice in the King's Bench Division determined that the central question was whether RTM’s consent was valid (meaning whether it was legally operative consent) to the activities about which he complained. She held that it was not, and that all of SBG's activities were therefore unlawful. Judgment was entered for RTM on 23 January 2025, with the question of remedies adjourned. The trial judge's approach to consent The trial judge approached the legal standard for consent by devising what she described as a three-part test drawn from the legislation and European authorities. She identified three 'distinct strands': first, 'good quality subjective consent', depending on the individual's actual state of mind; second, absent that, a fully autonomous choice by the individual about the grant of consent; and third, some minimum evidential standards for proof of consent.
proceeded directly from a damaged and defective condition of personal autonomy'.
The grounds of appeal SBG appealed the High Court’s decision on five grounds. The first two, which were the most substantial, were that the judge erred in deciding the case on the basis of arguments that RTM himself had never advanced (procedural unfairness) and that her legal analysis of what constitutes consent was wrong in law. The remaining grounds challenged the judge's findings on 'factual consent' on 26 July 2017, her characterization of SBG's use of cookies and the conclusion that SBG's profiling was necessarily unlawful. The Information Commissioner intervened to assist the court and, notably, agreed with SBG that the test for consent is essentially objective. 2
The Court of Appeal's reasoning Consent is an objective concept
In a judgment given by Lord Justice Warby, with whom Lord Justice Lewison and Dame Victoria Sharp agreed, the Court of Appeal allowed the appeal on all five grounds. The court's central holding is clear and authoritative. Consent, as defined in Article 4(11) of the UK GDPR 3 — a 'freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement' — is an entirely objective concept. In relying unambiguously on the language of the GDPR and the clearly stated language of the CJEU and the Court of Appeal itself, Lord Justice Warby has brought the test by which legally valid consent is measured back to the evaluation relied upon by law makers and regulators to date. The court identified two key observations about the legislative language. First, consent is constituted by an action — an 'indication' of the data subject's wishes — not by a subjective state of mind. Second, all four qualifying criteria (freely given, specific, informed and unambiguous) are also objective in nature and are to be assessed by reference to the data subject's outward 'indication' and its context, including the communications between the parties and the structural character of their relationship. To ensure consent is specific, for example, consent must be ‘clearly distinguishable from other
Applying this framework to the facts, the judge accepted that RTM had taken deliberate actions indicating consent, but held that none of the three criteria was met, meaning that consent could not be legally operative. She accepted RTM's evidence about the impact of his gambling problem and found that he 'lacked subjective consent', that 'the autonomous quality of his consenting behavior was impaired to a real degree', and that 'the quality of this Claimant's consenting was rather lower than the standard required' because of 'his gambling problem and his associated vulnerability and compromised autonomy'. Significantly, the judge acknowledged that RTM possessed legal capacity to consent and even accepted that, at some level, he 'wanted the direct marketing material — even perhaps craved it'. Nevertheless, she concluded that his consent was 'insufficiently freely given' because his 'consenting behaviours 2 https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/ 3 https://gdpr-info.eu/art-4-gdpr/
IMGL MAGAZINE | JUNE 2026
PAGE 59
Made with FlippingBook flipbook maker