Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
The Court of Appeal has confirmed that ‘consent’ for the purposes of data protection law and the Privacy in Electronic Communications Regulations 2003 (‘PECR’) is an entirely objective concept, easing concern for data controllers following the High Court’s approach to vulnerable users.
Chambers’ John Goss reported the High Court’s decision (link) of January 2025 in favour of the Claimant, a former client of the Defendant’s gambling platform. Collins Rice J considered the Claimant’s subjective lack of autonomy rendered the quality of his consent below the standard for the placement of cookies, processing personal data and sending of unsolicited direct marketing communications.
However, the Judge foresaw an inevitable corollary of her analysis as noted by Lord Justice Warby giving the leading judgment for the Court of Appeal at [68] which caused widespread practical uncertainty amongst businesses:
“… a data controller such as SBG could not guarantee its ability to “demonstrate” conformity with the consent requirements of data protection law and PECR. No system for obtaining consent could achieve that. There would always be the possibility that an individual user, such as RTM, suffers from a gambling addiction, of which the data controller does not and cannot know, which impairs the user’s ability to give subjective consent or compromises his genuine autonomy or both. In any such case the data controller’s conduct would be contrary to PECR. Absent another lawful basis, the data controller’s processing would also be unlawful. Compensation would probably be recoverable.”
SBG appealed on five grounds. The Court of Appeal unanimously allowed the appeal and restated the legal test for ‘consent’. It determined ‘consent’ pursuant to Article 4(11) GDPR is objective and capable of being obtained by an outward indication of the data subject’s wishes. It does not require proof of the data subject’s actual state of mind or autonomous decision-making capacity.
The Court of Appeal concluded as follows [9]:
(1) The question in all cases is whether the data subject has “given” consent to the processing or other activity. To prove this, a data controller must show that the data subject made a statement or took some other clear affirmative action amounting to an “indication” of their wishes with respect to the processing or direct marketing in question that “signifies agreement” to the relevant activity of the data controller. These are purely objective questions about the quality and significance of some identifiable communication by the data subject to the data controller. Typically, this will be by ticking a box or some similar act.
(2) The data controller must also prove to the necessary standard that the data subject’s “indication” met each of the four criteria prescribed by the legislation, namely that it was (i) freely given, (ii) specific, (iii) informed, and (iv) unambiguous. Each of these criteria is also objective in nature. A decision on whether the four criteria were probably satisfied will require an assessment of the data subject’s “indication” in its context including, in particular, the communications between the data subject and the data controller, and the structural character of the relationship between them.
(3) To prove consent, the data controller does not have to prove what was actually in the mind of the individual data subject at the time of the “indication”. It is neither necessary nor relevant for this purpose to explore whether the individual data subject was vulnerable, with an impaired ability to make fully autonomous decisions.
[…]
(5) I am not persuaded by the submissions of SBG and the ICO, that the actual or constructive knowledge of the data controller about the personal circumstances or state of mind of the data subject has a bearing on whether consent is established. […] I do not think it consistent with the language of the legislation or coherent to treat the data controller’s state of mind, actual or constructive, as a criterion for whether the data subject has given consent.
Furthermore, the Court of Appeal concluded it was unlikely Parliament had intended to “create a regime for consent with which it would be impossible for data controllers to comply, and to expose them to this legal risk” [70].
Subject to any appeal which may be brought by RTM, the Judgment will come as a relief to data controllers dealing with high-risk data subjects and those carrying out increasingly sophisticated profiling and marketing operations. It emphasises that presenting information clearly and storing consumers’ agreement to specific processing activities securely remain effective safeguards against legal challenge.
RTM v Bonne Terre Ltd & anor (ICO Intervening) [2026] EWCA Civ 488
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
