02 October 2019
Following its recent detailed examination of the functioning of Australia’s digital economy, the Australian Competition and Consumer Commission (ACCC) has released its Digital Platforms Inquiry (DPI) Final Report.
The ACCC’s recommendations are wide ranging, and include a series of proposals relating to data privacy which, if implemented, would have broad impacts across the entire economy and significant implications for global businesses that deal with Australian consumers.
We also see the potential for some unintended adverse outcomes for consumers.
The primary focus of the DPI was digital platforms and the media. Digital platforms typically operate under a distinct business model providing services to consumers for zero monetary cost in exchange for their attention and use of their data. The platforms then 'monetise' that data by selling targeted advertising, from which they earn the majority of their revenue.
This business model poses some specific challenges in terms of data privacy, but the ACCC makes a case for ‘economy-wide’ reforms, citing a number of other sectors with data practices it considers to be similar, including financial institutions, telecommunications service providers, retailers offering rewards schemes, airlines and media businesses.
It is fair to say that Australian data privacy regulation has not kept pace with the multiple ways in which businesses collect, use, share and deal in data as part of the digital economy. For the ACCC, however, this is not only about privacy, but also consumer protection.
In its analysis of consumer welfare, the ACCC places significant weight on consumer survey data which indicates a strong consumer preference for having control over the data collected about them (especially location data and internet browsing data) and how it is used and disclosed. While these results are hardly surprising, what the surveys do not appear to address is whether consumers value this control more than some of the benefits that access to data drives (e.g. improvements to the quality of services or the ability to offer services for free).
The ACCC is highly focused on the importance of consumers being able to make ‘informed choices’ about the handling of their data. Some of its key findings in this context include:
Most of the ACCC’s recommendations would bring Australian privacy law into closer alignment with the European Union General Data Protection Regulation (GDPR). However, the ACCC’s recommendations regarding consumer consent appear to be stricter than the GDPR in some respects. The ACCC’s key recommendations are:
Global convergence towards GDPR standards means that the ACCC recommendations that align with the European privacy regime are unlikely to impose significant additional regulatory burdens on the majority of businesses operating in Australia. However, the recommendations relating to consent, which are stricter than the GDPR protection standard, are likely to present a greater compliance challenge. In particular, when coupled with unbundling consents, more stringent consent requirements could present real IT system challenges, with systems needing to be able to record and implement diverse consent patterns on an individual consumer level based on the particular services acquired.
Further, both the consent recommendations and the proposed digital platforms privacy code arguably raise some fundamental issues in relation to the way digital platforms operate. The ACCC has acknowledged that data collection drives the ability to offer valuable services without charge and to improve those services over time. In an individual case, much of the data collected may not be necessary for the provision of the particular digital service a consumer is receiving. However, the potential cumulative impact of successive decisions by consumers to refuse consent for such data collection (or a simple failure to adjust mandated default settings which would prevent the collection) has not been addressed by the ACCC, either in terms of quality of service or the ability to offer services at no charge.
Perhaps the key takeaway from the data privacy sections of the DPI Final Report is that the ACCC does not view data privacy as an issue solely for privacy regulation – instead, it is thinking about it as a consumer issue that may equally be addressed under the Australian Consumer Law.
Australian privacy law reform is perhaps inevitable. In line with other jurisdictions, such as the US and Germany, we also expect to see the ACCC pursue enforcement action under competition or consumer protection legislation to address data privacy issues.
This publication is introductory in nature. Its content is current at the date of publication. It does not constitute legal advice and should not be relied upon as such. You should always obtain legal advice based on your specific circumstances before taking any action relating to matters covered by this publication. Some information may have been obtained from external sources, and we cannot guarantee the accuracy or currency of any such information.