Digital platforms inquiry final report released – potentially far reaching privacy impacts for Australian businesses

Key privacy related points

• The ACCC supports the introduction of much tougher penalties for privacy law breaches.
• A direct right of action (and class action) could be introduced for breach of the Privacy Act 1988 (Cth).
• The definition of consent could be amended to require express, opt-in consent.
• There are recommendations to bolster consumers’ rights to their personal information, including the introduction of the ‘right to be forgotten’ in Australia.
• Broader changes to the Privacy Act are also recommended to address developments in data analytics.

On 26 July 2019, the Australian Competition and Consumer Commission (ACCC) publicly released its final report into the Digital Platforms Inquiry. The Report specifically looks at the impact of digital platforms on consumers, businesses using these platforms to reach customers and news media using the platforms to disseminate their content. The Inquiry highlighted the intersection between privacy, competition and consumer protection considerations.

The Report makes recommendations in a number of areas including competition law, consumer protection, media regulation and privacy law. The recommendations relating to privacy extend beyond digital platforms. As foreshadowed in our earlier articles (which you can read here and here), the final report contains recommendations that could have a significant impact on how businesses and organisations handle personal information in Australia, if implemented.

The ACCC is advocating changes to laws to give consumers greater control over their personal information, to increase the accountability of businesses for data practices and to address the need for privacy laws in Australia to have a meaningful deterrence effect.

It restated some of its recommendations for amendments to the Privacy Act contained in its preliminary report as well as recommending further changes. Recommendations include:

• strengthening notification and consent requirements and pro-consumer defaults with respect to personal information;
• introducing direct rights for individuals to bring actions and class actions against APP entities in court to seek compensation for interference with their privacy under the Privacy Act as well as significantly higher penalties for interference with privacy to mirror increased penalties for breaches of the Australian Consumer Law;
• updating the definition of ‘personal information’ to include technical data such as IP addresses, unique device identifiers, location data, and any other online identifiers; and
• requiring the erasure of personal information of an individual without undue delay on receiving a request for erasure from the individual, unless retention is necessary for the performance of a contract with the individual, is required by law, or is otherwise necessary for an overriding public interest reason.

Further, the ACCC also recommended broader changes to the Privacy Act, including:

• reviewing the objectives of the Privacy Act to place a greater emphasis on privacy protections for individuals;
• reviewing the Australian Privacy Principles to impose an obligation for APP entities to use and disclose personal information by fair and lawful means (in addition to collecting personal information by fair and lawful means);
• reviewing the scope of the Privacy Act, particularly:
  • whether the Australian Privacy Principles should apply to businesses or organisations with an annual turnover of less than $3 million;
  • whether the employee records exemption should be narrowed; and
  • whether the exemption for registered political parties should be removed or reformed;
• reviewing the Privacy Act to include protections and standards relating to ‘inferred information’ (being information generated through the use of data analytics to infer additional information about an individual, which may include sensitive information);
• reviewing the Privacy Act to include requirements or standards for the de-identification, anonymization or aggregation of personal information to limit the risk of re-identification through the use of multiple datasets and data analytics; and
• considering whether the Privacy Act should be revised so that it could be considered by the European Commission to offer ‘an adequate level of data protection’ to facilitate the flow of information to and from overseas jurisdictions, such as the EU.

The ACCC also recommended the introduction of a statutory cause of action for serious invasions of privacy, which was previously recommended by the Australian Law Reform Commission. This would cover serious invasions of privacy that may not be captured within the scope of the Privacy Act.

In addition to the above, businesses and organisations should also be aware of the ACCC’s recommendations for changes to the Competition and Consumer Act 2010 (Cth), including:

• amending unfair contract terms legislation so that unfair contract terms are prohibited, and introducing penalties for the use of unfair contract terms; and
• introducing a prohibition against ‘unfair trading practices’, which could include:
  • changing the terms on which goods or services are provided without reasonable notice or the ability to consider the new terms; and
  • inducing consent by using very long contracts, providing insufficient time to consider a contract or using ‘all or nothing’ clickwrap consents.

Needless to say, if all of the ACCC’s recommendations were adopted the privacy compliance landscape in Australia would change significantly. Companies and government bodies would need to review their commercial practices and implement more comprehensive privacy compliance programs.

The Government had previously flagged that it will significantly increase penalties for serious or repeated privacy breaches and will increase the enforcement powers and resources of the Office of the Australian Information Commissioner.

Upon the release of the ACCC’s final report the Federal Treasurer, Josh Frydenberg MP, stated that the Government “… accepts the ACCC’s overriding conclusion that there is a need for reform – to better protect consumers, improve transparency, recognise power imbalances and ensure that substantial market power is not used to lessen competition in media and advertising services markets.” He indicated that the precise reforms required will be informed by a public consultation process that will run for 12 weeks. After that, the Government will finalise its response to the ACCC’s report by the end of 2019.

We will keep you updated on further developments.

Authored by:

Hazel McDwyer, Partner

David Smith, Partner

Raisa Blanco, Associate