\n\t
\n\tIn brief<\/p>\n
\tThe Court of Appeal has handed down an important judgment (RTM v Bonne Terre Ltd & Anor<\/a>) on the meaning of \u201cconsent\u201d in the context of data protection and ePrivacy law, and overturned what had been a problematic prior judgment of the High Court, which had left many businesses, especially those in the betting and gaming sector, facing an \u201cineradicable\u201d risk of claims that potentially they could not reasonably have defended. What is valid \u201cconsent\u201d under UK data protection and electronic marketing law?<\/p>\n Under the UK GDPR (Article 4(11)<\/a>) consent means: “any freely given, specific, informed and unambiguous indication of the data subject\u2019s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her\u201d.<\/p>\n Article 7<\/a>\u00a0puts the onus on the data controller to prove that the standard has been met.<\/p>\n Section 2(1) of the Privacy and Electronic Communications (EC Directive) Regulations 2003<\/a>\u00a0(\u201cPECR\u201d, which deal with the sending of direct electronic marketing to individuals and the use of cookies and similar technologies), adopts the Article 4(11) UK GDPR definition (and applies it to \u201csubscribers\u201d and \u201cusers\u201d as opposed to data subjects).<\/p>\n The facts of RTM v Bonne Terre<\/p>\n So far, so straightforward. But what happens in the case of someone who purports, by a clear affirmative action, such as ticking a box, to give a specific, informed and unambiguous indication of their wishes, signifies agreement to the processing of personal data relating to them, and to the receiving of direct electronic marketing, but who later argues that the consent was vitiated by factors of which the data controller\/sender of the marketing was unaware, and could not reasonably have been aware? Put another way, is the sending of direct electronic marketing on the basis of the objectively valid consent of someone who was subjectively incapable of giving valid consent, to be treated as lawfully sent?<\/p>\n The High Court decision<\/p>\n \u201cNo\u201d, said the\u00a0High Court in the first instance<\/a>. RTM was someone who, in his own submission, had engaged in \u201ccompulsive, out of control and destructive\u201d gambling, and claimed, in data protection and in misuse of private information, for damages on the basis that, as he argued, Bonne Terre (operating as Sky Betting and Gaming, or \u201cSBG\u201d) had “gathered and used extensive information, generated by his use of its platforms, unlawfully\u2026especially by way of personalised and targeted marketing which he could not handle and which fed his compulsive behaviour”.<\/p>\n Mrs Justice Collins Rice DBE had held in her judgment (despite RTM not pleading in these terms) that, even though RTM had not lacked capacity to consent, and \u201cthat he wanted the direct marketing material \u2013 even perhaps craved it\u201d he was one of a small subset (an \u201cirreducible minimum\u201d) of \u201cindividuals for whom decision-making\u2026was already out of control in relation to gambling, and for whom the consenting mechanisms and information provision meant nothing other than barriers to gambling to be overcome\u201d. Whilst SBG had adopted controls in line with gambling regulatory requirements and expectations to avoid the risk of marketing to \u201cproblem gamblers\u201d (the judge\u2019s words) and even though these controls \u201ccan and do help manage and minimise the particular risks of direct marketing to online gamblers\u2026they cannot and do not eliminate them\u201d. This was because he \u201clacked subjective consent\u201d; \u201cthe autonomous quality of his consenting behaviour was impaired to a real degree\u201d; and \u201cthe quality of [his] consenting was rather lower than the standard required\u201d, and \u201cinsufficiently freely given.\u201d<\/p>\n The first instance judgment had presented all businesses, but especially those in the betting and gaming sector, with a problem and a risk: i) how could they establish in each case the subjective aspect of a data subject\u2019s consent? and ii) if they could not establish that subjective aspect, how could they deal with the risk that marketing which would, on the face of it be lawfully sent, would be held not to be, if the recipient was one of the irreducible minimum whose consent was not, subjectively, valid? Perhaps unsatisfactorily, the judge had said that this was “a risk which is ultimately ineradicable. Problem gamblers may not always be easy to recognise, and there will always be relevant information about them which is ultimately unreachable by the provider, and properly so because it is information which is itself in the private domain”.<\/p>\n Court of Appeal confirms consent under UK GDPR is an objective test<\/p>\n The Court of Appeal has now roundly overturned the decision. Giving the main judgment, Lord Justice Warby revisited what a data controller must be able to demonstrate, in circumstances where consent is said to be present:<\/p>\n \tthe controller must \u201cshow that the data subject made a statement or took some other clear affirmative action\u2026that \u2018signifies agreement\u2019\u201d In a classic example of judicial understatement, Warby LJ noted that the effect of the decision of the judge below was to establish a \u201cprinciple that decisions deliberately made by a capacitous individual may nonetheless be vitiated for lack of consent\u201d and further noted that it was a \u201clegally novel\u201d principle, whose \u201ccontours are not clear to me\u201d.<\/p>\n Recitals 4<\/a>\u00a0and\u00a07<\/a>\u00a0of the UK GDPR are relevant here. Recital 4 reminds us that: “The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights”. Recital 7 meanwhile reminds us that: “Legal and practical certainty for natural persons, economic operators and public authorities should be enhanced”.<\/p>\n As Warby LJ notes, an \u201cinevitable corollary\u201d of the original ruling would be that a business \u201ccould not guarantee its ability to \u2018demonstrate\u2019 conformity with the consent requirements of data protection law and PECR\u201d, and “the unsatisfactory and ultimately opaque nature of the test for legally effective consent which the judge applied\u2026would create considerable legal and practical uncertainty for economic operators”.<\/p>\n Unless there is a further appeal by RTM, which would require permission from the Supreme Court,\u00a0the Court of Appeal has now gone a long way towards restoring legal and practical certainty as to the meaning of \u201cconsent\u201d in data protection law, and how data controllers should approach the task of gathering and proving consent.<\/p>\n
\n\tThe Court of Appeal has confirmed that consent under the UK GDPR and PECR is an objective test, meaning that data controllers do not need to establish individuated subjective consent.
\n\tBusinesses relying on consent as the lawful basis for processing personal data, particularly those in the betting, gaming and online marketing sectors, should take note of the court’s decision, which provides greater legal certainty around what constitutes valid consent under the UK GDPR and PECR.<\/p>\n
\n\tthey must also prove that \u201cthe data subject\u2019s \u2018indication\u2019 met each of the four criteria prescribed by the legislation, namely that it was (i) freely given, (ii) specific, (iii) informed, and (iv) unambiguous\u201d. Each criterion is an objective test: \u201cthe data controller does not have to prove what was actually in the mind of the individual data subject at the time of the \u2018indication\u2019\u201d.<\/p>\n
\n\t
\n\t
<\/p>\n","protected":false},"excerpt":{"rendered":"
In brief The Court of Appeal has handed down an important judgment (RTM v Bonne Terre…\n","protected":false},"author":2,"featured_media":548580,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[59,57,58,50,56,54,55],"class_list":["post-548579","post","type-post","status-publish","format-standard","has-post-thumbnail","category-united-kingdom","tag-gb","tag-great-britain","tag-greatbritain","tag-news","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/548579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=548579"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/548579\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/548580"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=548579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=548579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=548579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}