Consent versus contract

Field 01Four bases, and only one of them is yours to switch off

Data protection rules require a lawful basis for every processing activity, and there are four you will meet on a gambling account: consent, contract, legal obligation and legitimate interest. Consent is the only one you grant and can withdraw at will. Contract and legal obligation are the operator’s duties to provide the service and to meet the law, and you cannot withdraw them while still using the account. Legitimate interest is the operator’s judgement that the use is justified against your rights, and it is the only basis besides consent that you can formally object to.

Field 02Contract and legal obligation — the parts you cannot consent away

“We process your data to provide the service you asked for” is the contract basis, and it follows from the fact that you opened the account. It covers the operation itself: structuring the account, taking deposits, paying withdrawals, running the products and supporting you. “We process your data to meet the law” is the legal-obligation basis, and it covers verification, anti-money-laundering records and tax reporting. Neither is switchable, because neither is a choice — a request to stop them would be a request to stop being a customer or to break the law. This is why a data request that says “stop processing my data” cannot be granted as stated; what can be granted is the withdrawal of the consent-based uses.

Field 03Consent — specific, informed, and as easy to withdraw as to give

Valid consent has to be freely given, specific and informed, and it has to be as easy to withdraw as it was to give. That has practical consequences: a pre-ticked box is not consent, a single switch covering marketing, profiling and data-sharing is too broad to be specific, and a withdrawal buried behind a phone call is not as easy as the click that gave consent. Where the operator relies on consent, it must be able to prove which version you agreed to and when — which is why consent records are kept, and why withdrawing marketing consent updates the record rather than deleting it.

• Freely given
• Specific
• Informed
• Provable
• Withdrawable

Field 04Legitimate interest — the basis you can object to

Legitimate interest is used for things the operator judges necessary and balanced against your rights — fraud prevention, security monitoring, some analytics. It is not a free pass: the operator must be able to show why the interest is legitimate, that the processing is necessary for it, and that your rights do not outweigh it. You may object, and the operator then has to either stop or demonstrate compelling grounds that override your objection. There is one place where the objection always wins: direct marketing on legitimate interest must stop when you object, with no balancing test — which is why “unsubscribe” works even where the marketing was not run on consent.

Field 05Withdrawing marketing consent without losing the account

The withdrawal is straightforward once you know what you are turning off. Find the marketing preferences in the account, or the unsubscribe link in an email, or the data-protection contact in the privacy notice; state that you withdraw consent to marketing; ask for confirmation and the date. Two checks are worth making. First, that the account is not closed in retaliation — withdrawing marketing consent is not a ground to close an account, and if an operator behaves as though it is, that is a complaint. Second, that the messages actually stop within a short period, allowing for a final transactional notice. If they do not, the record of the withdrawal you kept is what the next escalation turns on.