The High Court has handed down judgment today in a claim by a former customer (the Claimant) against Bonne Terre Ltd and Hestview Ltd (t/a Sky Betting and Gaming) (the Defendant). In brief, the claim focused on the Defendant’s handling of the Claimant’s personal data over a limited period of time (2017-2019) immediately before and after the introduction of the GDPR.

The causes of action included a claim for misuse of private information, failure to respond to the Claimant’s objection request, and that the Defendant’s profiling of them for the purposes of direct marketing based on legitimate interests was unlawful. However, the Court declined to reach a decision on these points and instead turned her focus exclusively to (i) whether or not the Claimant provided valid consent to the use of cookies; and (ii) whether or not the Claimant provided valid consent to receive direct marketing.

In short, this is a judgment that examines the validity of ‘cookie consent’ and ‘direct marketing consent’.

In reaching her judgment, the Judge relies on a newly formulated interpretation of consent which comprises of “three distinct strands.” These three strands for valid consent are as follows:

1. Subjective: What was in the data subject’s mind when they gave their consent.
2. Autonomous: Whether or not a data subject is in a position to be able to determine the consequences of giving or withholding their consent.
3. Evidential: Can a controller evidence the consent that was obtained and that it was sufficient to meet parts (1) or (2).

The Judge goes on to explain that while there is a low threshold for subjective consent, there is a relatively high bar for autonomous consent.

In the present case she finds that the nature of the Claimant’s obsessive and disordered gambling made it impossible for him to provide ‘subjective consent’ to permit cookies and receive direct marketing as, based on the Claimant’s testimony, he ticked boxes in relation to cookies and direct marketing “without giving his mind to the matter or reading any of the accompanying material.” In essence, and as the Judge puts it, any choices made by the Claimant were not related to the options put to him, but were seen as a box ticking exercise which had to be navigated in order to satisfy his problematic gambling and not for the purpose of providing consent.

The Judge assesses the Claimant’s ‘autonomous consent’ in a similar manner, which is to say that the Claimant’s gambling behaviour impaired his ability to give his autonomous consent; or, to quote the judgement, that the Claimant’s consent was not autonomous as it was “too bound up with the craving or compulsion to access gambling, to which the consenting is experienced as a condition to be overcome, to meet the necessary legal standard.”

The Judge goes to great pains to limit the case to its facts – both the personal circumstances of this Claimant and the particular period in question: she says “I have a single data subject, a single set of facts and a single slice of historical time before me.” The failures of the Defendant were historical and bound up in its practices at the time vis-à-vis the Claimant. The judge also notes the Defendant’s “own policies and practices, and those of the wider online gambling industry, have since evolved so as even further to reduce the risk of claimants such as the present one” referring in particular to the Defendant’s developments with respect to safer gambling and transparency.

A determination on remedies is outstanding, in which the Judge will have to decide what financial relief (if any) to grant with respect to the claimed losses and distress. However, she notes in today’s liability judgment that she will have to deal with issues of causation in determining what if any loss is attributable to the Defendant and that such issues “may not be straightforward”. She closes by noting “It is only the matters for which [the Defendant has] been adjudged to be legally liable, in the period in question, and which are demonstrably causative of identifiable and quantifiable loss or harm, for which financial compensation can be expected.”