Sky Faces Legal Consequences for Data Mishandling in Gambling Addiction Case
Unlawful Customer Data Retention Upheld by Court: Sky Betting and Gaming Scenario
In a stunning verdict, Sky Betting and Gaming, a subsidiary of Flutter Entertainment, has been found accountable for illegally collecting and misusing a customer's data, who was struggling with gambling addiction.
The clandestine data gathering occurred via the use of cookies without obtaining explicit approval from the customer. This breach contravened the UK's stringent data protection laws, causing Sky to send targeted, personalized messages to the customer between 2017 and 2019.
Disputing the judgment, Sky has vowed to consider an appeal, pointing towards its recent strides in strengthening its safer gambling controls as evidence of its commitment to rectifying its ways.
The Dark Side of Data Tracking
The plaintiff, who suffered from a long-standing gambling addiction, lost over £45,000 ($56,000) to Sky over a decade-long period. The plaintiff argued that Sky should have recognized their addiction and prevented the sharing of their data with third parties without consent.
Multiple Data Subject Access Requests revealed an extensive cache of data stored about the plaintiff, with over 500 data points being tracked and recorded in real-time. Lawyers representing the plaintiff further disclosed that the majority of this data formed part of a larger profile used by Sky's marketing teams to identify the plaintiff as a high-value customer.
Will Prochaska, a spokesperson from the Coalition to End Gambling Ads, voiced grave concerns, stating, "This case offers us a glimpse into the inner workings of a single operator, but it appears these practices are standard across all licensed online gambling operators in Britain."
A Fight for Fairness
Despite Sky's potential recourse, its spokesperson expressed reservations about the judgment and hinted at an impending appeal. "We fundamentally disagree with this ruling and will be considering an appeal." The judge acknowledged the evolution of the industry since the time of the breach but maintained that the practices were unethical in their time.
Ravi Naik, the plaintiff's lawyer, expressed optimism, saying, "We hope this judgment will serve as a deterrent to online gambling companies, reducing harm to vulnerable individuals."
This ruling, far from being a solitary occurrence, marks Sky's second brush with UK regulations concerning customer data, having previously been rebuked in September 2024 over a similar incident involving the use of cookies to target ads at customers with gambling addictions.
Insights:
- Data Protection Regulations: The UK's data protection laws, primarily the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, mandate that personal data, including that of individuals with gambling addictions, is to be processed lawfully, fairly, and transparently. Organizations must inform data subjects about how their data is used and guarantee their right to access and control their data[5].
- UK Gambling Commission Guidelines: The Commission stresses the necessity of protecting customer data and ensuring that gambling operators adhere to data protection laws. This includes responsibly using data to prevent harm and ensuring data is not used to exploit customers[4].
- New Customer Protection Measures: As of October 31, 2025, operators will require customers to set financial limits before their first deposit and remind them every six months to review their account and transaction information. These measures are part of broader efforts to reduce betting-related harm[4].
- Anti-Money Laundering (AML) and Know Your Customer (KYC): While not directly related to addiction, AML and KYC measures require operators to verify customer identities and monitor transactions to prevent illicit activities[5].
- Regulatory Focus: The UKGC and other bodies are increasingly concentrating on reducing harm in the gambling industry, with a focus on using data more responsibly to prevent exploitation and ensuring operator transparency about customer data protection[4].
- The High Court's ruling against Sky Betting and Gaming, citing a breach of data protection laws, underscores the importance of safer gambling, especially in the handling of customer data.
- The plaintiff's case has brought to light the extensive data tracking of customers with gambling addictions, as evidenced by over 500 data points being tracked without consent.
- Ravi Naik, the plaintiff's lawyer, believes this judgment will serve as a deterrent for online gambling companies, reducing harm to vulnerable individuals.
- Sky's continued use of data tracking technology for targeted marketing in the past, despite being rebuked by UK regulations, raises concerns about the industry's adherence to data protection laws and ethical practices.
