The UK High Court of Justice has delivered a significant ruling against the operators of Sky Betting & Gaming (SBG), addressing critical issues of privacy and data protection in the context of the online gambling industry.
The case, RTM v Bonne Terre Limited and Hestview Limited, was heard in the King’s Bench Division Media and Communications List and case centred on allegations of improper data use and intrusive marketing practices by SBG.
Bonne Terre Limited is owned by Flutter Entertainment; Hestview is the data controller for the company.
The claimant, only identified in the case as “RTM,” described himself as a recovering online gambling addict.
He alleged that SBG’s marketing and data processing practices exacerbated his compulsive gambling behaviour, leading to “significant financial and emotional harm.”
Between 2017 and 2018, the period in question, RTM deposited over £31,000 into his SBG account, far exceeding his income and household expenses.
He claimed that SBG’s personalised marketing campaigns, powered by profiling algorithms, targeted him with offers and incentives that perpetuated his gambling addiction.
The claimant argued that these practices were unlawful and breached principles of data protection and privacy.
The defendants denied the allegations, maintaining that their data processing and marketing activities complied with applicable laws.
They asserted that the claimant had provided valid consent for the use of his data through cookie banners and user agreements.
SBG emphasised its adherence to legal requirements and regulatory frameworks, including those established by the UK Gambling Commission (UKGC). However, the regulator has also previously taken action against the operator.
GDPR violations played crucial role in ruling
At the heart of the case were several legal issues, including the lawfulness of data processing, the adequacy of consent mechanisms, and the principles of transparency, fairness, and purpose limitation.
The court analysed these issues under the Data Protection Act 1998, the General Data Protection Regulation (GDPR), and the Privacy and Electronic Communications Regulations (PECR) 2003.
It also considered the Gambling Act 2005, which governs the licensing and operation of gambling activities in the UK, and the Gambling Commission’s codes of practice.
One of the central questions was whether SBG obtained lawful consent for the use of cookies and the processing of personal data for targeted marketing.
The court reviewed the cookie banners and privacy notices in place during the relevant period and found them insufficient to meet the legal standard for informed and specific consent.
The claimant testified that he clicked through cookie banners without fully understanding their implications, focusing solely on accessing the platform.
The court noted that the design of these banners and the accompanying privacy notices failed to provide clear and comprehensive information, as required under Regulation 6 of PECR.
Player profiling becomes an issue
The judgment also examined SBG’s use of profiling and data analytics in its marketing practices. The company used detailed behavioural data to segment and target customers with personalised marketing campaigns.
These campaigns, which included frequent emails and push notifications, were designed to encourage higher engagement and spending.
While the defendants argued that such practices were standard in the industry, the court highlighted the risks posed by marketing to individuals exhibiting signs of gambling harm.
Evidence presented during the trial showed that the claimant’s gambling behaviour, including significant losses and escalating deposits, reflected signs of high risk. Despite this, he continued to receive targeted marketing communications.
The court further addressed the claimant’s contention that SBG’s profiling activities involved sensitive data related to his mental health and gambling addiction.
Under data protection law, such data is classified as special category data and requires explicit consent for processing.
The court found that SBG’s practices did not satisfy this requirement, as the claimant was not adequately informed about the extent and purpose of the profiling.
SBG’s approach to balancing marketing with safer gambling obligations was another focal point. The company operated a risk modelling system to identify customers at high risk of harm.
However, this system only triggered interventions, such as suspending marketing communications, when a customer’s risk score crossed a specific threshold.
Below this threshold, marketing continued without modification, even in cases where customers displayed concerning behaviour.
The court noted that this binary approach failed to account for the nuanced risks associated with gambling addiction.
Final judgment yet to be rendered
The court ruled in favour of the claimant on two key issues: the collection of his personal data through cookies for targeted direct marketing without obtaining his valid consent, and the delivery of targeted marketing emails to him without such consent.
This finding effectively resolves the core substance of the claim in the claimant’s favour.
Justice Rice emphasised that the decision is limited to the specific facts and historical context of this case. The ruling applies to the practices in place only during the period under scrutiny.
The issue of remedies was not addressed during the trial and has been deferred for further consideration based on the detailed findings of liability. Justice Collins Rice noted that determining an appropriate remedy may not be a straightforward process.
In similar cases involving problem gamblers, courts have occasionally denied remedies even when liability was established, citing challenges related to causation.
In this case, any financial compensation will be limited to harm or loss that SBG is legally responsible for during the relevant period, and only to the extent that such harm or loss can be clearly identified and quantified.
Further submissions on the matter of remedy are anticipated.