DATA PROTECTION IN UK GAMBLING
Disposal The Court of Appeal allowed the appeal on all five grounds and set aside the trial judge's order. The court itself determined that RTM had given legally valid consent to direct marketing, applying the correct objective test to the trial judge's own findings of fact. All remaining matters in the claim — including RTM's arguments that SBG's processing infringed other data protection principles — were remitted to the High Court for trial before a different judge. Costs of the appeal were awarded to SBG. Significance for the gambling sector The decision has been received with considerable relief by gambling operators. In the context of Gibson v TSE Malta LP (t/a Betfair) [2025] EWCA Civ 1589 6 and Calvert v William Hill Credit Ltd [2008] EWCA Civ 1427 7 , in which the court has repeatedly refused to impose a general duty of care on gambling operators, this decision closes off a ‘data protection side-wind’ to achieve what tort law otherwise will not. The trial judgment furthermore had generated alarm across the industry, not least because it was characterized at the time as 'groundbreaking' and was reported as front-page news. On the trial judge's analysis, any gambling service provider faced an 'ineradicable risk' that its marketing consents could be retrospectively invalidated by a customer who turned out to be a problem gambler, irrespective of whether the operator knew or could have known of the vulnerability. That risk has now been eliminated — at least so far as the consent question is concerned. Operators can now comfort themselves that, with an objective test for consent upheld, they can rely on their use of clearly designed consent mechanisms as evidence of consent: tick- boxes; scrolling through terms; and opt-in processes. They do not need to query a customer’s state of mind to accept such indications at face value. This is not a blank cheque, however. The Court of Appeal emphasized that consent mechanisms must still satisfy the objective requirements, in that the consent must be freely given, specific, informed and unambiguous. This essentially gives operators a roadmap for what legally operative consent
would look like and means that pre-ticked boxes and passive opt-out mechanisms would not satisfy the test. The Court of Appeal also cautioned that context matters, and in the regulatory environment in which SBG operates, the kind of customers it deals with, and the associated inherent risks, ‘the use of especially simple and clear language’ in obtaining consent could be called for. Practitioners advising gambling operators should not view this as a green light to ignore customers’ vulnerabilities altogether. The Court of Appeal was careful to observe that if the data subject makes it known to the data controller that they suffer from some affliction casting 'real doubt on his ability to make free choices', it 'might be argued that the processing of personal data would not be "fair" if undertaken at a time when the data controller knew or should have known that the data subject was suffering from some disability or external factor that overbore their will or compromised their ability to choose'. In this respect, operators are advised to invest in robust safer gambling systems, not just for compliance purposes, but because the absence of such systems could have a negative bearing when considering the fairness of the processing of customers’ data. Compliance with the more recently introduced LCCP SR 5.1.12 8 , which requires consent to be provided on a per channel and per product basis, will also support a defense against any data protection claims based on fairness. The Gibson and Calvert line of authority and this case together confirm there is no general duty of care. However, between the regulatory regime (SR 5.1.12 and the wider LCCP) and the data protection fairness principle, operators who ignore vulnerability signals do so at significant legal and reputational risk. Broader implications for commercial data controllers The implications of the ruling extend well beyond gambling. Lord Justice Warby acknowledged that the consequences of a subjective approach 'would not be confined to the gambling industry' but would reach other commercial entities, including those in sectors where compulsions and addictions are a known feature. Any business that relies on consent as its lawful basis for processing — whether for direct marketing, cookies
6 https://www.bailii.org/ew/cases/EWCA/Civ/2025/1589.pdf 7 https://www.bailii.org/ew/cases/EWCA/Civ/2008/1427.html 8 https://www.gamblingcommission.gov.uk/licensees-and-businesses/lccp/condition/5-1-12-direct-marketing-preferences
IMGL MAGAZINE | JUNE 2026
PAGE 61
Made with FlippingBook flipbook maker