Advertisers need to act now in response to the ACCC’s Digital Platforms Inquiry
If the ACCC's recommendations are implemented, big changes could be facing the advertising industry, warn Stephen von Muenster, Stephanie Scott and Rebecca Blumber. Accordingly, advertisers need to get ahead of the increased scrutiny and regulation.
We all know that data is being collected and used by digital platforms (most notably Google and Facebook) in advertising, media and communications. Among other scandals, the 2018 Facebook Cambridge Analytica data privacy breach highlighted how such use of data has a large-scale impact on individuals’ privacy. Up until recently, when that tick box appeared on screen, most people would blindly agree to their personal data being virtually shipped off around the world to be used in ways they were unlikely aware of. Cambridge Analytica has shone a light on the use of this data, and consumers are no longer sitting back quietly and allowing this to occur.
Closer to home, the Australian Competition and Consumer Commission (ACCC) is already flexing its muscles in respect of misleading and deceptive conduct under consumer law. The ACCC has commenced proceedings in the Federal Court against medical appointment booking app Health Engine, alleging that the platform has been collecting and disclosing users’ personal data to insurance brokers without consent. The app’s developers face millions of dollars in fines if they are found guilty of these alleged breaches.
The ACCC’s Digital Platforms Inquiry
While platforms such as Facebook and Google can be largely positive in the effects they have on business success, their collection of users’ personal data is controversial to say the least.
For advertisers and agencies, a lack of transparency means not knowing how or if their specified audience is being targeted, and how platforms charge for their data use in audience targeting. The sector should be regulated and policed.
Consumers, perhaps even more so than advertisers and agencies, are affected by data collection policies. There is a significant asymmetry of information and lack of bargaining power that exists between consumers and digital platforms. Consumers will often mindlessly tick a box or simply click a button to proceed, releasing their personal data with no appreciation of the consequences.
The ACCC’s recommendations, therefore, centre on safeguards for consumers, and transparency for agencies and advertisers.
Law reform and regulation
The report sets out multiple ways that the Privacy Act could be amended to enhance protections for consumers.
Firstly, by amending the definition of ‘personal information’ in the Act to include technical data, including all identifiers that could be used to distinguish individuals. This would bring breaches of data privacy into the remit of the Act and mean that consumers have the capability of benefitting from Privacy Act protections.
Secondly, the report recommends that the Privacy Act should require a better disclosure notice upfront for platforms collecting data. It would explain how a user’s data will be collected, used and disclosed, including ‘layered’ notifications, and short terms and conditions written in plain language.
The report also recommends consumer consent to collect, use and disclose personal data. This would mean the collection and use of data would be an opt-in system. This would undoubtedly impact the amount of data that could be collected, used and disclosed as consumers become more aware of their rights to data privacy.
General recommendations
A major change to look out for is the potential creation of a special branch of the ACCC that will handle all things data privacy and digital platform content. This will mean that digital platforms will be monitored by dedicated, trained officers who will be tasked with proactively calling out breaches. Essentially, there will be a police-like force ensuring that data privacy is adhered to.
The Office of the Australian Information Commissioner (OIAC) will also have a part to play should the recommendations be implemented. A regulatory data privacy code of practice is in development and this will be yet another supervisory mechanism that will make the OAIC a route for people to lodge complaints and request information about where their data is being used.
Under the protocol recommended, digital platforms may be required to disclose information about their use of personal data in ways that were not required previously.
What has parliament already done?
In March 2019, in between the release of the preliminary report and the final report of the digital platforms inquiry, parliament announced a set of changes that were already in the works for implementation.
The OIAC is already set to receive an additional $25m over five years to ensure that it has the resources to realise its increased enforcement and control powers.
This will go hand in hand with a significant increase in the amounts the OIAC can recover in fines. There has also been an announcement of significant increases in the amount of money (now upwards of $10m), that someone can recover should they prove a breach of data privacy laws.
Parliament has also deemed it necessary to include a right for individuals to ensure their personal data ceases to be used upon request. This is somewhat linked to the consumer data right (CDR) introduced in November 2017. The CDR refers to the right a consumer has to safely access the personal information and data that a business holds about them, and the ability to instruct the business to transfer this data to a third party of the consumer’s choice upon request. The right will first apply to the banking sector from 1 February 2020, followed by the energy sector, with telecommunications to follow.
Ultimately, businesses operating in this space must begin taking the issue of privacy in the digital realm more seriously, otherwise they could start to face some serious consequences in the near future. Consequences that could not only cost them huge amounts in terms of financial loss, but reputational loss.
Stephen von Muenster (partner), Stephanie Scott (solicitor) and Rebecca Blumber (law clerk) work at DVM Law
I kinda love how more than one week after publish and this article has no comments despite being a brilliant piece on industry-wide regulation.
Come on people. Say something…
It reminds me of a police line up and the guilty party just can’t look people in the eye.
This entire empty comments space is the media and marketing industry collectively looking the other way whilst whispering “make it go away”
Come on guys. Face facts. Facebook & Google stole everyone’s data and we’re all worse than complicit. We gave them all the money. We’re almost arms traders at this point.
Can someone please regulate the crap out of all this illegal surveillance and get our individual privacies back please?
Maybe along the way we can find a better way to eek a living than giving society to Larry & The Zuck in return for free email and an easy way to chat with mates…
#hopeful
User ID not verified.
I have had a Netflix account for over a decade. First the platform change that made me choose either streaming or mail or pay more if I wanted both and then the continual increases in prices for streaming. Now it is harder and harder to find good things and then the constant waiting and wondering about the series I like and whether they will be renewed or not… it is crap. Then delays its on and then its not… it sucks… as for their demographic target… retirees are a bigger audience and spend more time in front of their screens than anyone… so market for us! We have money… spend and buy too… not the same crap kids do but we have funds and our wealth is higher than theirs… they’re all living at home any way using their parents accounts so screw them… they don’t make the world go around…
User ID not verified.