Advertisers need to act now in response to the ACCC’s Digital Platforms Inquiry

If the ACCC's recommendations are implemented, big changes could be facing the advertising industry, warn Stephen von Muenster, Stephanie Scott and Rebecca Blumber. Accordingly, advertisers need to get ahead of the increased scrutiny and regulation.

We all know that data is being collected and used by digital platforms (most notably Google and Facebook) in advertising, media and communications. Among other scandals, the 2018 Facebook Cambridge Analytica data privacy breach highlighted how such use of data has a large-scale impact on individuals’ privacy. Up until recently, when that tick box appeared on screen, most people would blindly agree to their personal data being virtually shipped off around the world to be used in ways they were unlikely aware of. Cambridge Analytica has shone a light on the use of this data, and consumers are no longer sitting back quietly and allowing this to occur.

Closer to home, the Australian Competition and Consumer Commission (ACCC) is already flexing its muscles in respect of misleading and deceptive conduct under consumer law. The ACCC has commenced proceedings in the Federal Court against medical appointment booking app Health Engine, alleging that the platform has been collecting and disclosing users’ personal data to insurance brokers without consent. The app’s developers face millions of dollars in fines if they are found guilty of these alleged breaches.

The ACCC’s Digital Platforms Inquiry

While platforms such as Facebook and Google can be largely positive in the effects they have on business success, their collection of users’ personal data is controversial to say the least.

For advertisers and agencies, a lack of transparency means not knowing how or if their specified audience is being targeted, and how platforms charge for their data use in audience targeting. The sector should be regulated and policed.

Consumers, perhaps even more so than advertisers and agencies, are affected by data collection policies. There is a significant asymmetry of information and lack of bargaining power that exists between consumers and digital platforms. Consumers will often mindlessly tick a box or simply click a button to proceed, releasing their personal data with no appreciation of the consequences.

The ACCC’s recommendations, therefore, centre on safeguards for consumers, and transparency for agencies and advertisers.

Law reform and regulation

The report sets out multiple ways that the Privacy Act could be amended to enhance protections for consumers.

Firstly, by amending the definition of ‘personal information’ in the Act to include technical data, including all identifiers that could be used to distinguish individuals. This would bring breaches of data privacy into the remit of the Act and mean that consumers have the capability of benefitting from Privacy Act protections.

Secondly, the report recommends that the Privacy Act should require a better disclosure notice upfront for platforms collecting data. It would explain how a user’s data will be collected, used and disclosed, including ‘layered’ notifications, and short terms and conditions written in plain language.

The report also recommends consumer consent to collect, use and disclose personal data. This would mean the collection and use of data would be an opt-in system. This would undoubtedly impact the amount of data that could be collected, used and disclosed as consumers become more aware of their rights to data privacy.

General recommendations

A major change to look out for is the potential creation of a special branch of the ACCC that will handle all things data privacy and digital platform content. This will mean that digital platforms will be monitored by dedicated, trained officers who will be tasked with proactively calling out breaches. Essentially, there will be a police-like force ensuring that data privacy is adhered to.

The Office of the Australian Information Commissioner (OIAC) will also have a part to play should the recommendations be implemented. A regulatory data privacy code of practice is in development and this will be yet another supervisory mechanism that will make the OAIC a route for people to lodge complaints and request information about where their data is being used.

Under the protocol recommended, digital platforms may be required to disclose information about their use of personal data in ways that were not required previously.

What has parliament already done?

In March 2019, in between the release of the preliminary report and the final report of the digital platforms inquiry, parliament announced a set of changes that were already in the works for implementation.

The OIAC is already set to receive an additional $25m over five years to ensure that it has the resources to realise its increased enforcement and control powers.

This will go hand in hand with a significant increase in the amounts the OIAC can recover in fines. There has also been an announcement of significant increases in the amount of money (now upwards of $10m), that someone can recover should they prove a breach of data privacy laws.

Parliament has also deemed it necessary to include a right for individuals to ensure their personal data ceases to be used upon request. This is somewhat linked to the consumer data right (CDR) introduced in November 2017. The CDR refers to the right a consumer has to safely access the personal information and data that a business holds about them, and the ability to instruct the business to transfer this data to a third party of the consumer’s choice upon request. The right will first apply to the banking sector from 1 February 2020, followed by the energy sector, with telecommunications to follow.

Ultimately, businesses operating in this space must begin taking the issue of privacy in the digital realm more seriously, otherwise they could start to face some serious consequences in the near future. Consequences that could not only cost them huge amounts in terms of financial loss, but reputational loss.

Stephen von Muenster (partner), Stephanie Scott (solicitor) and Rebecca Blumber (law clerk) work at DVM Law


Get the latest media and marketing industry news (and views) direct to your inbox.

Sign up to the free Mumbrella newsletter now.



Sign up to our free daily update to get the latest in media and marketing.