The ACCC's new case on Google's collection and use of consumer personal information

In brief 8 min read

In a second case of its kind globally, the Australian Competition and Consumer Commission (ACCC) announced on 27 July 2020 that it had commenced proceedings in the Federal Court alleging that Google LLC (Google) misled consumers by failing to adequately disclose changes to its privacy policy about the way consumers' personal data is collected and used.¹

In late 2019 the ACCC commenced a separate case against Google claiming the tech company misled consumers about the circumstances in which their location data is collected and how to opt out of this.² Allens' report on that case is found here. The hearing in that case is scheduled for November 2020. Google has previously stated it intends to defend the claims.

These cases continue the ACCC's pursual of competition and consumer issues relating to digital platforms. The ACCC has indicated that it hopes the case will set a precedent for all businesses operating online about the importance of communicating in clear and simple language with consumers.

Key takeaways

• The ACCC alleges that Google failed to obtain explicit and informed consent from its consumers about the use of their data and acted contrary to representations made in its privacy policy.
• The case highlights the intersection between competition, consumer and privacy law. The ACCC is stepping into the gap to address privacy issues where the OAIC may not have the resources or a sufficient legislative basis to do so.
• Australian businesses can expect more cases like this in the future, especially if the ACCC is successful in its campaign to introduce an unfair practices prohibition.

The ACCC's case against Google

In 2007/2008, Google acquired a company called DoubleClick. DoubleClick supplied ad tech services to publishers (which offer advertising inventory) and advertisers (which pay to use this inventory). Google now supplies these services through its own brands. At the time, regulators around the world did not oppose the transaction. The two companies were not considered close competitors. Google had also indicated in the United States merger review process that it would not combine the data obtained by DoubleClick's ad tech services with the data obtained by Google's other offerings (including personal information obtained through Google accounts, eg Gmail data and Chrome browser sign-in data). This was not a legally enforceable commitment or undertaking which Google was required to give in those proceedings, and the ACCC is not treating it as a false statement.

In 2016, Google changed its privacy policy to allow for the combination of these sets of data. In seeking consent from consumers to combine this data, Google prompted its account holders to click 'I agree' to a pop-up notification (see below). The ACCC alleges this notification insufficiently explained how Google planned to combine consumers' data and so failed to obtain consumers' explicit and informed consent for the change in Google's use of their data.

Some new features for your Google Account

We've introduced some optional features for your account, giving you more control over the data Google collects and how it’s used, while allowing Google to show you more relevant ads.

The ACCC's case revolves around this 2016 change. Broadly, there are two allegations:

• First, the ACCC claims Google misled consumers by failing to properly inform them that Google would begin to combine data collected from third party websites and apps, with the personal information contained through consumers' Google accounts and services. The combination of this data meant Google could connect actions taken on a non-Google website with a particular Google account-holder. The ACCC says that by combining the datasets, Google improved the profitability of its advertising business because this combined data is particularly valuable for advertisers who are seeking to target particular audiences. The ACCC also argues that the 'I agree' notification was misleading because consumers could not have properly understood the changes it was making or how their data would be used, and so did not – and could not – give informed consent.
• Second, the ACCC claims Google misled consumers by stating in its pre-2016 privacy policy that it 'will not combine DoubleClick cookie information with personally identifiable information unless we have your opt-in consent'. The ACCC claims this was misleading, because – as above – Google did not obtain consumers' explicit and informed consent to make the 2016 changes.

So, how did the ACCC want Google to obtain this informed consent? In a press briefing on 26 July 2020, the ACCC Chairman Rod Sims stated that the ACCC expects 'short, clear statements' which tell the consumer in simple terms what the proposed change is and how it impacts them, both positively and negatively. In this case, Sims suggested Google could have told consumers:³

'…if you agree to this, we are going to combine … personally identifiable information we have on your Google account with your browsing activity on non-Google sites. If you agree to that, here's the benefits, here's the issues…'

Step aside OAIC: the ACCC in the privacy space

The ACCC is moving into the privacy regulatory space.

The decision to take action in this case is further evidence of the ACCC's move towards becoming an active regulator in relation to privacy concerns. The ACCC appears to increasingly consider privacy issues to be part of its consumer protection role. This has been previously demonstrated in the ACCC's final report on the Digital Platforms Inquiry, which included sweeping recommendations to strengthen privacy protections and improve data handling practices of organisations regulated by the Privacy Act 1988 (Cth) (the Privacy Act). The DPI also recommended the introduction of a prohibition on unfair trading practices that would cover situations where businesses tried to induce or force consumers into consenting to the collection and use of their data. This would make it easier to target 'bad' data practices. The ACCC is campaigning hard for this prohibition, with Rod Sims stating it is time to bring the law's treatment of unfair trade practices 'into the current day.'⁴

Taken together with the ACCC cases against Google, this is evidence of the ACCC's increasing willingness to use the provisions in its consumer law toolbox to address privacy and data issues. Indeed, the ACCC views consumer law as having an important and much broader role than traditionally perceived: 'if we are seeking to enhance economic welfare, I believe that consumer law should get much more attention than it does.'⁵

With this in mind, it is becoming even more important for organisations to ensure their privacy policies and other communications with consumers accurately describe their practices in relation to the collection, use and disclosure of personal information, as these documents may come under the scrutiny of the ACCC.

OAIC's role as the privacy regulator.

The OAIC had previously expressed a preference for a more conciliatory regulatory approach to working with entities 'to facilitate legal and best practice compliance' as expressed in its Guide to Privacy and Regulatory Action (Guide). Interestingly, the latest June 2020 version of the Guide has removed this statement. This may indicate an intention by the OAIC to become a more active regulator, consistent with the more aggressive approach taken by other regulators in the wake of the Financial Services Royal Commission.

However, various commentators have expressed concerns that the OAIC is too under-resourced to properly conduct its regulatory functions. In recent years, the OAIC's duties and workload have expanded substantially with the introduction of the mandatory data breach notification scheme and the Consumer Data Right (CDR) regime. More recently, the OAIC has also been given the oversight role of the COVIDSafe contact tracing app.

In addition, while the position in respect of the extra-territorial application of the Australian Consumer Law has previously been considered and settled in case law, that issue is only now being considered in relation to the Privacy Act in the OAIC proceedings against Facebook. The OAIC is therefore still playing catch-up.

Collaboration between the ACCC and the OAIC.

While there is currently no formal memorandum of understanding between the ACCC and the OAIC, the two regulators work closely together as joint regulators of the CDR, as formalised in the ACCC/OAIC Compliance and Enforcement Policy for the CDR. The OAIC also made submissions to the DPI, and broadly supports the ACCC's final recommendations in relation to the Privacy Act and privacy regulatory framework. It will be interesting to see how the ACCC and the OAIC will cooperate and manage the growing intersection between privacy compliance and consumer protection.

What this means for businesses in Australia

ACCC Chairman Rod Sims has stated that this case's purpose is to set boundaries about what companies dealing with consumer data can and cannot do. The ACCC wants to target – and in future prevent – companies from setting up processes that produce 'deception by design'.

Given this case and the ACCC's enforcement priorities, it is likely the ACCC will carry out more enforcement action of this kind. As time goes on, enforcement action is likely to extend beyond the digital platforms to other digitally-integrated companies that collect and use consumer data. This has a number of implications for businesses operating in Australia:

• Expect further action by the ACCC in the privacy space.
• Companies need to be clear and accurate in the representations they make to consumers, including in documents like privacy policies and collection notices.
• The ACCC believes that had consumers 'really known' what the change meant, many would not have agreed to being tracked. It is important to obtain informed consent from your consumers about any changes being made to the collection and/or use of their data.
• Consumer law has a very wide application. These considerations apply even if you are not a major market participant.
• Promises or behavioural undertakings made in the process of a merger review should not be wholly relied on. The ACCC seems likely to treat these more critically, going forward.⁶

The ACCC has firmly indicated it intends to stay on top of 'changing circumstances and dynamic markets' in digital and digitally integrated markets.⁷ Businesses will need to as well.

Please contact us if you would like to further understand the implications of this case for your business, or the ACCC's focus on digital markets more generally.