DATA PROTECTION IN UK GAMBLING
matters’, so customers must be aware that they are consenting to marketing specifically, not just agreeing to general terms and conditions. To ensure consent is informed, the customer must be provided with clear, comprehensive and easily accessible information about what data will be processed, how it will be used for profiling and what marketing the customer will receive – noting that ‘especially simple and clear language’ may be required in the gambling context. Importantly, operators must be able to evidence the consent mechanism relied upon and the information provided, so reliable record keeping would be required to uphold such a defense. The court drew support from the CJEU's decisions in Planet 49, Orange Romania and Meta Platforms , all of which it read as indicating an objective test. Domestically, the court noted the Court of Appeal's earlier observation in Cooper v National Crime Agency [2019] EWCA Civ 16 4 that the notion of consent is 'an objective one, which depends on the outward manifestation of consent by the data subject'. Authoritative guidance from the Article 29 Working Party 5 , the EDPB and the ICO was held to be 'firmly in favor of an objective approach'. The subjective approach is unworkable The court articulated a series of powerful practical objections to the trial judge's subjective analysis. A data controller such as SBG could never guarantee conformity with consent requirements if the test depended on the data subject's internal mental state, because there would always be the possibility of an unknown vulnerability impairing the user's ability to give 'subjective consent' or compromising their 'genuine autonomy'. This ‘irreducible risk’, which the trial judge held ‘the law places…on the data controller’, was deemed to be the Court of Appeal to be impractical and not what privacy law demands. While the trial judge found such risk a cost of doing business and a matter for operators to measure how much effort and cost they chose to put in to drive that risk down, the Court of Appeal felt the balance struck by the High Court between ‘the right to do business’ and ‘the right to protection of personal data’ was ‘impractical’ and not what Parliament intended. Furthermore, the Court of Appeal determined that such consequences would not be confined to the gambling industry but would extend to other sectors in which compulsions and addictions are a known feature, such as the sale of alcohol, and indeed to any situation where vulnerability or external circumstances (such as duress) might disable an individual
from making a free choice. The court also found the trial judge's test to be 'novel' and its 'precise nature elusive', observing that the principle that decisions deliberately made by a capacitous individual may nonetheless be vitiated for lack of consent was without precedent. As Lord Justice Warby noted, the judge had accepted that RTM possessed legal capacity and desired the marketing, yet still found his consent to be legally ineffective — a conclusion that 'cut across established rules' and lacked 'appropriate precision'. The data controller's knowledge is irrelevant to consent An important subsidiary issue was whether the data controller's actual or constructive knowledge of the data subject's vulnerability could bear on whether consent was established. Lord Justice Warby held that it was not 'consistent with the language of the legislation or coherent to treat the data controller's state of mind, actual or constructive, as a criterion for whether the data subject has given consent'. Such a qualification would significantly undermine the objective approach, introduce multiple subjective tests and carry most of the same problems of legal and practical uncertainty. Procedural unfairness On the first ground of appeal, the court held that the judge's decision was also procedurally unfair. RTM had argued that he did not give his consent; not, as the trial judge had found, that the consent given was impaired and therefore invalid. This meant that SBG had not had an adequate opportunity to address this argument, nor the three-part subjective analysis before it was deployed to decide the case against them. 'Factual consent' and the remaining grounds On grounds 3 to 5, the court held that the trial judge had erred in her assessment of 'factual consent' being given on 26 July 2017, finding that on a proper application of the law it followed from the judge's own factual findings that RTM did give an indication of his wishes signifying agreement to direct marketing, most likely by ticking a box to opt in. The Court of Appeal also agreed that the finding on cookies mis- stated a concession given by SBG in oral submissions and that the conclusion on profiling was parasitic on other erroneous conclusions.
4 https://www.gov.uk/employment-appeal-tribunal-decisions/mr-m-cooper-v-national-crime-agency-ukeat-0016-17-la 5 https://www.edpb.europa.eu/about-edpb/who-we-are/legacy-art-29-working-party_en
PAGE 60
IMGL MAGAZINE | JUNE 2026
Made with FlippingBook flipbook maker