RTM v Bonne Terre Limited & Anor

Consent relied on to justify cookies or personalised direct marketing must be free, specific, informed, active and unambiguous. Whether it meets that standard is fact-sensitive and must be assessed on the evidence concerning the individual data subject, the consenting process and the surrounding circumstances.

Online gambling carries a recognised risk that problem gamblers’ apparent consent may be compromised by impaired autonomy and a compulsion to gamble. A controller cannot rely solely on generic consent systems or statistical probabilities where the individual evidence shows that the acts of consent were merely barriers to accessing gambling. The controller bears the legal risk of defective consent.

The claimant, an anonymised recovering online gambling addict, sued operators of the Sky Betting and Gaming platforms. He alleged that his gambling data had been obtained through cookies, profiled and used for personalised direct marketing, including frequent marketing emails, without legally operative consent.

The defendants relied on consent and, for profiling, legitimate interests. The central issues were whether the claimant’s cookie and direct-marketing consents were sufficiently free, informed, specific, active and autonomous, and whether the particular circumstances of his problem gambling affected their legal effectiveness.

1. Consent standard. Under the applicable data protection and electronic communications regimes, consent for cookies and direct marketing had to be free, specific, informed, active and unambiguous. The controller had to be able to demonstrate that consent. The assessment was fact-sensitive and concerned both the subjective quality of the claimant’s consent and the autonomous quality of the decision-making process.
2. Evidence and context. Positive box-ticking and carefully designed privacy notices could provide strong evidence of autonomous consent, but could not guarantee it. The court had to examine the individual factual matrix, including the design of the consenting process, the information supplied, the claimant’s behaviour and the nature of the processing.
3. Online gambling. Personalised marketing of gambling to problem gamblers presented a known and ineradicable risk that apparent consent would be compromised by gambling-related compulsions and impaired autonomy. The defendants’ marketing-suppression system did not eliminate that risk. The relevant gambling codes were part of the factual matrix under the Gambling Act 2005, although regulatory compliance was not itself determinative.
4. Application. The claimant’s evidence showed that he clicked through cookie and privacy mechanisms without attending to their substance and while in a highly compulsive gambling state. His engagement with direct marketing was closely bound up with that compulsion. On the balance of probabilities, his consenting behaviour was insufficiently free, informed, specific, distinct and unambiguous to support lawful processing.
5. Accordingly, the defendants’ use of cookies for personalised direct marketing and their targeted email marketing were unlawful. The profiling was parasitic on those activities and disclosed no separate lawful basis. The court did not determine the subordinate data protection issues or analyse misuse of private information in detail. Judgment was given for the claimant on liability, with remedy deferred.