Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
RTM v Bonne Terre Ltd & anor [2025] EWHC 111 (KB) is the first really thorough exploration in this jurisdiction of the concept of ‘consent’ in data protection law, considering each of the DPA 1998, the UK GDPR and the Privacy in e-Communications Regulations.
The defendants were the companies which are responsible for the gambling platform Sky Betting & Gaming (“SBG”). The Claimant was a former client of SBG who had significant issues controlling his gambling. He brought a claim against SBG under the DPA 1998, UK GDPR, PECR and in misuse of private information relating to the way SBG gathered and used information to profile and market its services to him, in particular through use of cookies.
Collins Rice J reviewed in detail the various legal frameworks, particularly in relation to consent and legitimate interest. She identified the different aspects of legally effective consent under the different regimes, and provided substantial guidance on the interaction between consent and individual autonomy. She also made clear that ‘commercial freedom is a collective good’ and that a balance has to be struck between collective freedom and individual privacy.
Ultimately, the claim was allowed. Because of this particular data subject’s lack of autonomy as a problem gambler, the quality of his consent was below the required standard for processing personal data in respect of direct and personalised marketing in this field. The consequences of that decision for RTM are yet to be determined – depending on issues of causation common in gambling claims, it does not follow that he will be entitled to recover substantial losses.
More broadly, this is likely to be a significant decision for all data controllers who rely on consent (or, to a lesser extent, legitimate interests) as a lawful basis for data processing. It provides considerable assistance on what these concepts mean, if not total clarity about when consent will or will not be found legally effective by the courts. But it is also a decision that comes from a very specific context, where the data controllers in question were dealing with high-risk data subjects and carrying out exceptionally sophisticated profiling and marketing operations. It should not be taken as open season against companies that make use of cookies or conduct profiling or direct marketing.
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
