The UK Court of Appeals has overturned a High Court decision to provide clarity around consent collection for marketers.
The UK Court of Appeal has outlined a new more specific set of principles for direct marketing, consent, and profiling in relation to the adopted general data privacy regulation (GDPR).
The judgement set out in RTM v Bonne Terre Ltd, which overturns a High Court decision, clarifies the use of personal data in marketing for British advertisers, especially in the gambling sector, PPC Land reports.
The basis of the case is centred around the definition of consent under GDPR, and how this can be assessed for the purpose of personalised communications and data.
RTM argued that Bonne Terre (which operates as Sky Betting and Gaming, or SBG) had “gathered and used extensive information, generated by his use of its platforms, unlawfully… especially by way of personalised and targeted marketing, which he could not handle and which fed his compulsive behaviour”.
The appellate court diverged from the High Court’s approach by rejecting its analysis framework for establishing consent, instead choosing to view the data subject’s conduct through an objective lens, assessing whether RTM’s consent was “informed, specific, unambiguous and freely given”.
The appeals judge determined that RTM’s mental state, including any impairments pertaining to a gambling disorder, were not relevant for the purpose of the legal test.
The Court of Appeal therefore overturned the High Court’s decision, determining that data controllers must “show that the data subject made a statement or took some other clear affirmative action… that ‘signifies agreement’”; and also prove “the data subject’s ‘indication’ met each of the four criteria prescribed by the legislation, namely that it was (i) freely given, (ii) specific, (iii) informed, and (iv) unambiguous”.
Each criterion is an objective test: “The data controller does not have to prove what was actually in the mind of the individual data subject at the time of the ‘indication’.”
Ruling is a ‘sensible judgement’
By absolving data controllers of pre-determining the mental state of the data subject in order to gain subjective consent – which would likely have made GDPR compliance virtually impossible for large-scale data controllers – this ruling established legal and practical clarity for consent within GDPR, and how this should be collected and proved.
“This is an important and sensible judgment,” said Patrick Rennie, head of data protection at Wiggin, the law firm representing SBG.
“Controllers need to understand what data protection law requires of them and how to comply with it. The original judgment left controllers, particularly operators, in an impossible situation akin to strict liability. The Court of Appeal’s decision brings greater clarity, allowing controllers to focus on delivering services in a compliant and confident way.”
