That's not how burden of proof works. Anyhow, it's not exactly spying if you're telling your users that you're doing it. It's completely legal. This is exactly the reason why privacy policies exist. Companies can get in trouble for breaking DPA though.
A familiar example might be if a user buys a product or service and the company, employee, or owner who has responsibility towards keeping whatever data that was gathered during the transaction private -Shipping/personal details etc leaks them. This is illegal and can be reported to whatever ICO which is local to where the business is situated. The general procedure is a fine but it varies depending on where your business is situated - in some cases, it can even be seen as criminal.
If you're unsure on what Jagexs' privacy policy is, feel free to read it at https://www.jagex.com/en-GB/terms/privacy.
You're well within your right to decline the TOS/Privacy policy and stop using Jagex products if you find them too intrusive. My conclusion is that you really don't know what you're talking about and refused to post any proof because you didn't have any. Disregarding the privacy policy, it's also crystal clear that the client does in fact report back OS versions. https://github.com/runelite-extended/runelite/blob/25ce6c2ee91c30b65498bc1d6ea46c4bfde9dcf3/runescape-client/src/main/java/DesktopPlatformInfoProvider.java