The ACCC Digital Platforms Inquiry Final Report Released: Big changes to Australia’s privacy and consumer laws recommended

The Final Report of the Australian Competition and Consumer Commission (ACCC) Digital Platforms Inquiry (Report) was released on 29 July 2019.¹ The Report includes 23 recommendations which encompass a broad cross-section of laws, including competition, consumer protection, privacy law and media regulation, which reflects “the intersection of issues arising from the growth of digital platforms”.²   

Our Focus Paper provides a summary of the various ACCC recommendations to amend and strengthen Australia’s privacy and consumer laws.

Background

For a number of years, the ACCC has been concerned with the dominance of digital platforms and their impact on the economy.  The ACCC’s Inquiry focused on three types of digital platforms: online search engines, social media platforms and other digital content aggregation platforms and their impact on:

• competition in the media and advertising markets; and
  
• three groups of users:
  
  • advertisers (being the biggest category of business users of digital platforms);
    
  • media content creators; and
    
  • consumers.

The Report noted the substantial growth of digital platforms with Australian consumers frequently using platforms, especially those provided by Google and Facebook. Each month, for example, approximately 19.2 million Australians use Google while 17.3 million Australians use Facebook.³

Privacy issues identified by the ACCC

The ACCC identified a number of consumer privacy concerns which relate not only to digital platforms but the wider economy. Concerns included that:

• consumers are not properly informed about how their data is collected and used and they do not have any real control over the scope of data collected. Problematic data practices include the use of click-wrap agreements and standard form terms (presented on a take-it or leave-it basis), which make it difficult for consumers to provide consent to use of their data freely;
  
• consumers do not have any ability to make informed choices. Terms of service and privacy policies can be very long and complex, as well as ambiguous; and
  
• consumers are not protected adequately and, under existing laws, there is a lack of effective deterrence.
  
• In making the various recommendations contained in the Report, the ACCC sought to address the concerns identified above.

Recommendations – amendments to Australian privacy laws

1. The Privacy Act needs strengthened protections⁴

The ACCC noted that, on 24 March 2019, the Australian Government flagged the introduction of increased penalties and a range of other measures to protect online privacy, including increased penalties for repeated or serious breaches of privacy (the greater of AU$10 million, three times the value of the benefit obtained from the misuse or 10% of the company’s annual Australian turnover); new rules to protect vulnerable groups, such as children; and an obligation for social media platforms to cease use or disclosure of personal information when requested by an individual.

The ACCC recommended further changes to the Privacy Act 1988 (Cth) (the Act) (in addition to those flagged earlier this year) including:

• amending the definition of “personal information” contained in the Act to make it clearer that technical data, such as IP addresses and location data, which may be used to identify an individual, may be personal information which must be handled in accordance with the Act.
  
• strengthening the requirements for notice and consent:
  
  • Collection notices provided at the time of collection must be concise, easily accessible, written in plain language and provided free of charge.
    
  • Consent must be “freely given, specific, unambiguous and informed and…any settings for additional data must be preselected to ‘off’.” Consent should be required when personal information is not only collected but is also used or disclosed, the only exceptions being where the personal information is required to perform a contract with the consumer, where required by the law or if in the public interest.
    
• providing additional consumer rights:
  
  • a right to request the erasure of their personal information; and
    
  • a right to commence legal proceedings seeking compensation for interferences with their privacy in breach of the Act.

2. Broader reform of Australian privacy laws⁵

The ACCC determined that the problems identified above in respect of digital platforms, including the increased collection of consumer data; the use of click-wrap agreements, standard form terms of service and bundled consents; and the lack of adequate information and choice about data practices applies more broadly across the economy and not just to digital platforms.  Accordingly, any changes to privacy laws should apply economy-wide to protect consumers on a long-term basis and maintain consumer trust in respect of the free flow of information required for the digital economy.

3. An OAIC Privacy Code of Practice for digital platforms⁶

The ACCC recommended that the OAIC develop a Privacy Code of Practice which would apply to digital platforms. The Code would set out additional obligations applying to digital platforms in respect of notification and consent, opting-out, children’s data, data retention, information security and complaints handling. The OAIC would enforce the Code and the ACCC considered that the proposed stronger penalties for breaching the Act (outlined above) should also apply to breaches of the Code.

4. Introduction of a statutory tort for serious invasions of privacy⁷

Noting that the introduction of a statutory tort was recommended previously by the Australian Law Reform Commission, the ACCC considered that a statutory tort would protect individuals against serious invasions of privacy which do not necessarily fall within the scope of the Act.  The ACCC envisages the tort would require the plaintiff to have a reasonable expectation of privacy in the circumstances and the invasion of their privacy must be an invasion of seclusion or a misuse of private information. The public interest in privacy would need to outweigh countervailing public interests such as freedom of the media or freedom of speech.

Recommendations – amendments to the Australian Consumer Law

The Report recommended two amendments to the Australian Consumer Law (ACL)

1. Prohibition against unfair contract terms⁸

In conducting the inquiry, the ACCC observed contract terms which cause a significant imbalance between platforms and consumers. While unfair terms can be declared void by a court, this does not necessarily have a deterrent effect on businesses. The ACCC recommended that civil pecuniary penalties be introduced for including unfair contract terms in consumer and small business standard form contracts. The ACCC considers this would deter businesses from including unfair terms in both terms of service and privacy policies. 

2. Prohibition against certain unfair trading practices⁹

The ACCC also noted other practices of concern such as digital platform operators:

• changing terms without reasonable notice; and
  
• using practices which discourage consumers from exercising their legal rights, for example, requiring consumers to provide personal information which is not necessary before they can access services.

To address these concerns (and, for example, presenting click wrap consents on a take-it or leave-it basis), the ACCC recommended that the ACL be amended to prohibit “unfair trading practices”. Work would be required to ensure the prohibition was sufficiently defined.

Next Steps

We will be monitoring closely the release of draft legislation to implement the reforms recommended in the Report.  In the meantime, if you have any questions about how Australia’s privacy laws may apply to your business, please get in touch.

---

Liability limited by a scheme approved under Professional Standards Legislation.
© ADDISONS. No part of this document may in any form or by any means be reproduced, stored in a retrieval system or transmitted without prior written consent. This document is for general information only and cannot be relied upon as legal advice.