Sky Betting & Gaming (SBG) has been successful in its appeal of a High Court ruling in a case regarding the handling of customer data.
In January 2025, the High Court ruled that the Flutter-owned brand unlawfully processed a customer’s data and subsequently sent them direct marketing materials over a historic period of time.
The defendant in question, referred to throughout the case as RTM, claimed SBG used cookies to obtain his data without his consent, before sending personal marketing campaigns despite his long-standing history of gambling addiction.
SBG countered by claiming RTM did in fact give consent to sharing data by agreeing to web notices regarding cookie use and updated GDPR regulations.
RTM first opened a SBG account in 2010 and claimed that between May and December 2018, he deposited nearly £32,000, averaging monthly losses of £1,793.
At the time of the High Court ruling, Justice Rowena Collins Rice ruled in the defendant’s favour, leading the High Court to create new thresholds for what constitutes obtaining consent under UK GDPR and PECR regulations.
The judge ruled that RTM had not given legal operative consent nor subjective consent. It was ruled the defendant’s quality of consent was “rather lower than the standard required”.
However, SBG appealed the decision, claiming that the court was wrong to conclude that the operator hadn’t obtained the customer’s consent.
SBG also argued that the High Court had made a ruling “on a matter that was not pleaded by the claimant, specifically that the claimant had not argued that their consent was invalid due to their gambling disorder, and therefore SBG had not had an opportunity to present a defence to this issue”.
The operator also attested that the High Court also “took the wrong approach in law on what amounts to legally valid consent”, highlighting that UK GDPR regulation stipulates that consent needed to be “specific, informed, unambiguous and freely given”.
Led by Lord Justice Warby, the Court of Appeal upheld SBG’s claims, stating that the test for consent remains “objective, not subjective”.
The court decision read: “To prove consent, a data controller must show, first, that the data subject made a statement or took some other clear affirmative action amounting to an ‘indication’ of their wishes with respect to the processing or direct marketing in question that ‘signifies agreement’ to the relevant activity of the data controller.
“These are purely objective questions about the quality and significance of some identifiable communication by the data subject to the data controller. Secondly the data controller must prove to the necessary standard that the data subject’s ‘indication’ met each of four criteria prescribed by the legislation, namely that it was (i) freely given, (ii) specific, (iii) informed, and (iv) unambiguous. Each of these criteria is also objective in nature.
“The data controller does not have to prove what was actually in the mind of the individual data subject at the time of the ‘indication’. It is neither necessary nor relevant for this purpose to explore whether the individual data subject was vulnerable, with an impaired ability to make fully autonomous decisions.”
The Court of Appeal ruled that the case must be remitted to the High Court, but that it “invites submissions on the scope of the issues to be remitted”.
SBG were represented by Wiggin during the case and Patrick Rennie, partner and head of data protection at the law firm, said the judgment was “important and sensible”.
“Controllers need to understand what data protection law requires of them and how to comply with it,” he added.
“The original judgment left controllers, particularly operators, in an impossible situation akin to strict liability. The Court of Appeal’s decision brings greater clarity, allowing controllers to focus, on delivering services in a compliant and confident way.”
EGR has approached Flutter for comment.
The post Sky Betting & Gaming wins High Court appeal over customer data case first appeared on EGR Intel.
Court of Appeal sides with the Flutter-owned brand 13 months after initial ruling claimed the operator unlawfully handled personal information
The post Sky Betting & Gaming wins High Court appeal over customer data case first appeared on EGR Intel.