ACCC preliminary report on Google and Facebook could lead to major privacy law changes

On 10 December 2018 the Australian Competition and Consumer Commission released its preliminary report in relation to the Digital Platforms Inquiry which the ACCC has been conducting at the direction of the Commonwealth Government.

The Inquiry is into the impact of online search engines, social media and digital content aggregators on competition in the media and advertising services markets. The extent of influence Google and Facebook have in those markets has made them the principal focus of the Inquiry.

This is a very detailed report running well over 300 pages. It contains a number of very significant preliminary recommendations by the ACCC. There will be much written about these recommendations but in this article we focus on those related specifically to privacy law.

The ACCC acknowledges that the issues it is investigating are complex and are not unique to Australia, and it has stated that its engagement with stakeholders over coming months may result in considerable change to its preliminary views.

In relation to privacy the ACCC notes that digital platforms collect a large variety and amount of user data. The ACCC’s preliminary view is that consumers are generally not aware of the extent of data collected, nor how it is collected and used. The length and complexity of online terms of service and privacy policies contributes to the problem.

The ACCC has also formed the preliminary view that there is a considerable imbalance in bargaining power between digital platforms and consumers. Consumers are offered “take it or leave it” terms and bundled consents, limiting their ability to give a true consent to digital platforms’ collection and use of their data. They are unable to make informed choices, and the ACCC considers that current privacy laws don’t effectively deter certain data practices that exploit the information asymmetries and bargaining power imbalances between digital platforms and consumers.

As a result the ACCC proposes (as preliminary recommendations) the following amendments to the Privacy Act 1988 (Cth). If implemented, some of these could have very significant implications for the way companies handle consumer data in Australia.

• Collection of consumers’ personal information must be accompanied by a concise, transparent, plain English notification of the collection.
• The definition of consent should be amended to require express, opt-in consent. Data collection settings must be pre-selected to “off”. These changes would bring Australia into closer alignment with European Union data protection law.
• Penalties for breaches of the Privacy Act should be significantly increased and the enforcement resources of the Office of the Australian Information Commissioner (OAIC) increased.
• Individual consumers should be given a direct right of action for breach of privacy under the Privacy Act. Currently their main avenue of redress begins with them complaining to the OAIC and the OAIC investigating.

A further preliminary recommendation proposes that the OAIC (with the ACCC) develop an enforceable code of practice under the Privacy Act containing specific obligations on how digital platforms must inform consumers about the handling of their personal information and obtain their informed consent.

Finally the ACCC makes a preliminary recommendation that the Commonwealth Government introduce a statutory cause of action for serious invasion of privacy, in line with recommendations by the Australian Law Reform Commission that have been under discussion in privacy law circles for some years.

After engaging with stakeholders the ACCC is due to release its final report on 3 June 2019.

Stay tuned – there will be plenty more to come out of this Inquiry!

Authored by:
David Smith, Partner