The Information Commissioner's Office (ICO) has issued a reprimand to Bonne Terre Ltd, trading as Sky Betting and Gaming, for unlawfully processing people's data through advertising cookies without their consent. This action highlights the importance of adhering to data protection regulations and the consequences of non-compliance.
Background to the Breach
The ICO revealed in a press release that between 10 January and 3 March 2023, Sky Betting and Gaming handled individuals' personal data and transmitted it to advertising technology firms immediately upon their access to the SkyBet website. This occurred before users were given the choice to accept or decline advertising cookies. Consequently, their personal data could be utilized to deliver personalised advertisements without their prior consent or awareness.
ICO's Response
Upon discovering the breach, the ICO swiftly addressed the issue. They investigated whether Sky Betting and Gaming was misusing personal data to target vulnerable gamblers. Although no deliberate misuse was found, the ICO determined that the company was processing data using certain cookies in a way that was not lawful, transparent or fair. The investigation revealed inadequate measures for obtaining user consent for advertising cookies. Consequently, the ICO issued a formal reprimand, stressing the need for immediate compliance with data protection laws. Sky Betting and Gaming has since updated its practices to allow users to reject advertising cookies before their personal information is shared for targeted advertising purposes.
ICO's Wider Programme on Cookie Non-Compliance
The reprimand to Sky Betting and Gaming is part of a broader initiative by the ICO to address cookie non-compliance across various industries. The ICO has been actively working to ensure that organisations adhere to the rules regarding the use of cookies and similar technologies. This programme includes:
- Guidance and Resources: The ICO provides comprehensive guidance and resources to help organisations understand their obligations under data protection laws. This includes detailed information on how to obtain valid consent for cookies and how to implement transparent cookie policies.
- Enforcement Actions: The ICO has been taking enforcement actions against companies that fail to comply with cookie regulations.
- Public Awareness Campaigns: The ICO conducts public awareness campaigns to educate individuals about their rights regarding cookies and how they can manage their cookie preferences.
Impact of the ICO's Programme
The latest statistics on the ICO’s enforcement actions show significant progress. In November 2023, the ICO contacted 53 of the UK’s top 100 websites, warning them about potential enforcement actions if they did not comply with cookie consent regulations. By March 2024, 80% of these organisations had updated their cookie banners to ensure compliance.
Additionally, the ICO’s efforts have led to a broader ripple effect, with many other organisations proactively making changes to their cookie practices even without direct contact from the ICO.
Our views
The ICO's reprimand of Sky Betting and Gaming serves as a crucial reminder for all companies using cookies. Here are some key takeaways and considerations:
- Obtain Explicit Consent: Ensure that you obtain explicit consent from users before placing any non-essential cookies on their devices. This consent must be informed, specific, and freely given.
- Transparency is Key: Be transparent about your use of cookies. Provide clear and comprehensive information about the types of cookies you use, their purposes, and how users can manage their cookie preferences.
- Regular Audits and Reviews: Conduct regular audits and reviews of your cookie practices to ensure ongoing compliance with data protection laws. This includes keeping up-to-date with any changes in regulations and guidance from the ICO.
- User Control: Implement mechanisms that allow users to easily manage their cookie preferences. This includes providing options to accept or reject cookies and to change their preferences at any time.
By adhering to these principles, companies can not only avoid regulatory actions but also build trust with their users by respecting their privacy and providing a transparent online experience.
Read our other recent data protection articles:
Time for a Change? - UK Government announces new Data (Use and Access) Bill
AI and Procurement – A Practical Approach
Exploring the Future: ICO's Report on Quantum Technologies
Memorandum of Understanding signed between the National Crime Agency and the Information Commissioner’s Office
Meta Ireland issued a €91 million fine
Get in touch
The content of this page is a summary of the law in force at the date of publication and is not exhaustive, nor does it contain definitive advice. Specialist legal advice should be sought in relation to any queries that may arise.
Related expertise
Law Firm of the Year
We are proud to have been named Law Firm of the Year at the prestigious Legal Business Awards 2024!
Freeths secured almost unanimous support from the judges for this win. The firm achieved another consecutive year of double-digit growth, enhanced its fast-growing London office, and became one of the first law firms to achieve B Corp certification.
Contact us today
Whatever your legal needs, our wide ranging expertise is here to support you and your business, so let’s start your legal journey today and get you in touch with the right lawyer to get you started.
Get in touch
For general enquiries, please complete this form and we will direct your message to the most appropriate person.