Did Google get off lightly? ACCC v Google and ACL penalty regime changes

The Federal Court has handed down its penalty decision in Australian Competition and Consumer Commission v Google LLC (No 4) [2022] FCA 942 (ACCC v Google)[1], confirming its landmark findings against the tech giant from late last year[2]. Google LLC (Google US), the parent company of Google Australia Pty Ltd (Google Australia), was ordered to pay a substantial fine of $60 million for violations of the Australian Consumer Law. Both Google US and Google Australia were also required to enter into consumer compliance measures, and ordered to pay 50% of the ACCC’s costs.

The decision

This is the ACCC’s first public enforcement outcome following its Digital Platforms Inquiry launched in 2019. The decisions in ACCC v Google are significant for a number of reasons, including that:

• it is the first time that the ACCC has taken a significant enforcement action for a breach of a privacy-related issue (usually the purvey of the OAIC, as privacy regulator) against a private sector organisation;
• it represents one of the largest fines ever imposed on an offshore (US) entity – issues of the ‘having an Australian link’ were a key factor in this case; and
• the majority of the contravening conduct took place during 2017, and prior to the increased ACL penalty regime taking effect in September 2018, where the maximum fine could have been calculated up to 10% of the combined turnover of Google US & Google Australia (as contravening entities). Google may have indeed taken the view it was getting off lightly, noting that, had the conduct taken place post September 2018, it would be looking at a much more severe consequence.

Background

The Federal Court found that both Google US and Google Australia had made misleading representations to consumers about the collection and use of location data in the set-up process of their Android devices. In particular, the Court held that Google had from 2017 to 2018 impliedly represented that by turning ‘location history’ off, Google would not be able to obtain, retain or use location data of individual users. It was found however that this was still possible, unless the user made changes to the ‘web & app activity’ settings, which were enabled by default.

The Court had, with help from consumer behaviour experts, paid particular attention to how the average reasonable user would behave in the set up process of their devices and Google services. It is noteworthy that much less importance was given by the Court to Google’s privacy policy, which outlined its collection and use of data. The Court instead preferred to understand the user’s practical interaction with Google’s data collection and use settings.

Key takeaway – Misleading and deceptive conduct

The Court found that both Google entities had engaged in misleading and deceptive conduct pursuant to Section 18 of the Australian Consumer Law (ACL)[3]. Section 18 ACL is a ‘catch all’ general protection provision which covers undesirable trade practices that do not fall under prohibitions of specific unfair practices contained in Chapter 3 ACL. Section 18 applies to all business dealings and is not limited to consumer interactions.

Business conduct is misleading or deceptive if it conveys a meaning inconsistent with the truth and the overall impression of the conduct induces or is capable of inducing error. An intent to mislead or deceive is not required.

It is sufficient that only a small portion of the target audience is misled; as long as that part of the target audience can be believed to have acted reasonable.

The decision in this case illustrates perfectly that misrepresentations can be implied and do not have to induce error in the majority of the reasonable target audience.

Privacy Policy alone will not save misleading or deceptive conduct.

The Court found specifically that it was not sufficient that the relevant information regarding the collection of location data and its use was contained in Google’s Privacy Policy. A noteworthy point for many organisations to take away from this case – having a long, detailed and ‘good’ privacy policy will not save you if the practices behind the policy do not stack up.

Simple settings, such as ‘location history off’ can amount to implied representations.

The fact that the option to turn off the ‘location history’ setting did not effect this in practice, was sufficient to induce the error under the requirements of Section 18.

It is unlikely that Google US and Google Australia will appeal the decision. The ACCC, Google US and Google Australia were in agreement when they made their penalty submissions, which were ultimately accepted by the Federal Court. Given that Google Australia, which the Court found to have adopted and endorsed the conduct of Google US and to have equally violated the ACL, was spared from a penalty, demonstrates that it could have been a lot worse for Google.

Significant increases to maximum penalties proposed

Yesterday the Federal Government released draft legislation proposing significant increases to the maximum penalties that apply to contraventions of the Competition and Consumer Act 2010 (Cth) (CCA) by companies and individuals. The proposed maximum penalty for a company would be raised to:

• the greatest of $50 million (up from $10 million);
• three times the value of the benefit obtained; and
• 30% of the company’s turnover during the period of the contravention.

For individuals the maximum penalty would be raised to $2.5 million. The proposal provides another reminder of the importance in minimising the risk of contraventions of Part IV of the CCA and the ACL.

Taking the proposed changes to the penalty regime into consideration, organisations, particularly those with digital platform offerings, should take note of the many learnings from ACCC v Google. Reviewing general privacy and security practices, procedures and online conduct can minimise the risk of misleading conduct or misleading or deceptive representations and might save organisations millions.

If you found this insight article useful and you would like to subscribe to Gadens’ updates, click here.

Authored by:

Sinead Lynch, Partner (Foreign Qualified, not admitted in Australia)
Freya vom Bauer, Associate

[1] Australian Competition and Consumer Commission v Google LLC (No 4) [2022] FCA 942.

[2] Australian Competition and Consumer Commission v Google LLC (No 4) [2021] FCA 367.

[3] Section 18 Competition and Consumer Act 2010 (Cth) – Schedule 2.