ACCC releases its first Digital Platform Services Inquiry Interim Report

A focus on online messaging services 12 min read

The ACCC recently published the Digital Platform Services Inquiry Interim Report (Interim Report) as part of its role in monitoring the impact of digital platforms on competition and consumers.

The Interim Report examines the wide-reaching privacy / data handling, competition, consumer and small business implications related to the increasing use of online private messaging services. It also revisits these implications in respect of search and social media services, which the ACCC originally considered in its original 2019 Digital Platforms Inquiry Final Report.

Key takeaways

• Although the Interim Report is directly relevant to online service providers, the ACCC's findings have important implications for businesses more generally, particularly online businesses.
• The ACCC has expressed concerns around the data collected by platforms through online tracking and new products. Given the Attorney General's review of the Privacy Act (discussed in our recent Insight), it is likely we will see reforms that impose stricter consent requirements on businesses and that seek to give consumers greater control over the ways their data is handled.
• The Interim Report criticises what the ACCC sees as vague language used in privacy policies to describe the use of cookies and other tracking practices, and suggests that failures to properly disclose data collection and use practices and obtain adequate informed consents could place businesses in contravention of consumer protection laws. We expect this to be an area of increased regulatory scrutiny and enforcement action, with the ACCC expecting businesses to make very clear and specific disclosures regarding data handling practices in customer-facing documentation.
• The ACCC has raised concerns that the expansion of online platforms into other markets provides additional opportunities to collect data and create an ecosystem of products and services that interoperate. The ACCC will continue to monitor relevant competition and consumer impacts in this area. The ACCC will also continue to advocate for changes to competition, consumer and small business protection and privacy laws.

Who in your organisation needs to know about this?

Legal, risk and compliance, as well as IT and customer relations teams, should be aware of the likely reforms to the Privacy Act, the likely increased regulatory scrutiny of cookies and tracking technologies, and the growing concerns around data as platforms expand into other markets.

Background

In June 2019, the ACCC released its Digital Platforms Inquiry Final Report (DPI Final Report) which considered the impact of online search engines, social media and digital content aggregators on competition in the media and advertising services markets. Allens published a two-part series in which we considered the ACCC's findings and recommendations, with a focus on competition, consumer protection and copyright issues in Part 1, and privacy and data protection issues in Part 2.

Following the release of the DPI Final Report, the ACCC was directed to monitor the impact of digital platforms on competition and consumers over the next five years. In performing this role, the ACCC will release a report every six months. On 23 October 2020, the ACCC released its first Interim Report. This Interim Report looks at competition, consumer and privacy issues associated with online private messaging services and updates previous findings reached by the ACCC with regards to social media and search services.

Key findings of the ACCC

• Consumer reliance on online messaging services is growing, escalated in particular by the COVID-19 pandemic and isolation requirements. However, there remains significant consumer concern around data collection practices, tracking and privacy in relation to these private messaging services.
• Large online platforms such as Facebook and Apple have significant competitive advantage over standalone providers of private messaging. This is due to the significant size of their user base and increasing 'identity-based network effects', where services are not interoperable and become more attractive the more they are used by a person's family, friends and colleagues. While complementary services exist, the ACCC suggests, for example, that Facebook's messaging services are not subject to constraint at least in relation to social use cases.
• There is a significant power imbalance between large digital platforms and consumers, with most Australians having a limited understanding of the data practices they consent to. A lack of transparency around how customer data is collected, used and shared by apps and third parties enables user data to be misused. Businesses risk engaging in misleading conduct if accurate and adequate disclosures about data practices are not provided, and informed consent is not obtained, for these practices (including as they change over time).
• There is also a significant power imbalance between large digital platforms and small businesses seeking to advertise on those platforms. Digital platforms often impose potentially unfair terms on small businesses in standard form contracts (eg rights to vary terms without notice, suspend or terminate accounts, broad discretions to remove content, etc). The ACCC reiterated its previous recommendation that platforms need to improve dispute resolution options for small businesses. The ACCC continues to advocate that unfair contract terms should be made illegal and subject to penalties (currently a court can only declare them void).

Key Implications

Changes to the Privacy Act in the medium term seem likely

A key focus of the Interim Report was the potential consumer harms posed by increased consumer use of the big players' online messaging services. The Interim Report found that:

• Australians' online activity is being extensively tracked, with large platforms (including Facebook and Google) key recipients of this data. This is enabled through the prevalence of their third party scripts in popular websites and software development kits (SDKs) within apps. According to the ACCC, the increasing ability to track and profile individuals increases the risk that consumers may experience discriminatory or exclusionary harm;
• new products and services, including voice assistants, allow for an increased ability to collect consumer data. This increased data collection raises the risk of inadvertent or unintended disclosure of information, which may result in decreased consumer welfare from reduced privacy; and
• most Australians have a limited understanding of the data practices they consent to. The terms and privacy policies of online private messaging services provide users with little clarity regarding the extent to which their data will be collected, used and shared with others. Vague disclosures are used to enable the platforms to collect extensive information about users.

In light of the above, the ACCC reiterated the need to act on its previous recommendations of amending the Privacy Act and the Australian Consumer Law to allow consumers greater control over the ways their data is handled. In the DPI Final Report, the ACCC proposed a number of significant changes to the Privacy Act, which, if implemented, will require businesses to revisit the operation of their consents and notification mechanisms for collecting, using and disclosing personal information. We unpacked these proposed changes in Part 2 of our Insight series on the DPI Final Report.

The Attorney General recently commenced its review of the Privacy Act as a key part of the Government's response to the Digital Platforms Inquiry. The review will likely result in reforms to the Privacy Act in the medium term which impose stricter requirements for when and how consent is obtained. We discussed the Issues Paper published by the Attorney General and its likely implications in our recent Insight.

Increasing scrutiny on the use and disclosure of cookies and other tracking technologies

Although online private messaging services collect significant amounts of personal information through cookies and tracking technologies, and this information can be shared with third parties, the ACCC found that the extent to which users are tracked, and how their information is used for advertising purposes, is not made clear. The ACCC discusses at length what it considers is vague language used to describe such practices in terms and privacy policies, noting that:

• some platforms only refer to advertising after long lists of other uses for collected data, or have reduced the level of detail surrounding advertising practices in recent versions of terms or policies, despite it often being a key source of revenue for the platform;
• disclosures regarding the use of cookies often emphasise the benefits for users such as convenience and product improvement, and advertising is framed as a means to personalise experiences and provide free services; and
• platforms are generally unclear about who or what entities are considered to be third parties and what information is shared with them.

The Interim Report highlights a disconnect between consumer expectations with regards to transparency and privacy, and the actual practices of online platforms. Despite the widespread use of tracking technologies and targeted advertising by online messaging services, four in five Australians surveyed by the OAIC consider it to be a misuse for an organisation to record their online activities without their knowledge or request information that is not relevant to the purpose of the transaction.

In light of the above, we anticipate two key implications for businesses:

• The use of cookies and other tracking technologies is likely to face increasing scrutiny by the ACCC (and potentially the OAIC as well). We believe the ACCC will increasingly expect businesses' to make very clear and specific disclosures regarding the use of such technologies (even where cookies and tracking technologies are provided by third parties). As such, businesses should consider their use of cookies and whether clear disclosures are currently made to users.
• More generally, the Interim Report shows that the ACCC is continuing to focus on the content of user terms and conditions and privacy policies and whether they adequately describe the scope and nature of data collection and use practices to users. It seems clear that the ACCC will continue to view inadequate or vague disclosures as potential contraventions of the Australian Consumer Law. The ACCC considers that failures to adequately disclose data collection and use practices and to obtain informed consent (eg including for changes to those practices over time) could constitute misleading conduct. We note, for example, that the ACCC is currently prosecuting inadequate disclosures regarding the collection and use of consumer data as misleading or deceptive conduct, including in a recent action against HealthEngine and in two cases against Google.

Increased concerns around data as platforms expand into other markets

The Interim Report also raised concerns around competition and consumer outcomes as large platforms expand into other markets. The ACCC observed that expansion and acquisitions enable large platforms to:

• effectively create an 'ecosystem' of products and services that interoperate, and preinstall or set as default software owned by that platform in other hardware. As a result, consumers are susceptible to being 'locked-in' to the one ecosystem as they adopt more of the platform's services and devices; and
• benefit from additional opportunities to collect vast amounts of consumer data. This creates the risk that platforms will combine and control data from multiple sources to attain or maintain their market power.

The ACCC considered there were inherent challenges in reviewing digital platform acquisitions, and referred to its continued work with digital platforms on a voluntary merger notification protocol. The protocol is intended to give the ACCC advance notice of proposed transactions to address its concerns around strategic (or 'killer') acquisitions.

The ACCC also made observations on the growth of voice assistant and augmented reality services in Australia and the consequential expansion of data collection and associated usage practices connected with those services. The ACCC considered that these services presented potential competition and consumer harms.

The ACCC indicated that it will continue to monitor the competition and consumer effects of any expansion by digital platforms into other markets and sectors.

Implications for DPI Final Report recommendations

A number of the Interim Report's findings support recommendations previously made by the ACCC in the DPI Final Report. The below table sets out some of these key recommendations, the Government's response, and their likely implications.