Tell me in two minutes
The Australian Competition and Consumer Commission (ACCC) recently published a report (Report) about businesses that collect, sell and/or share users’ personal information for purposes such as market segmentation, risk management and property data analysis. This is an area that has already attracted significant ACCC scrutiny, and in its Report the ACCC signals an intention to consider these ‘data brokers’ with an increasingly broad scope, including firms that provide non-traditional data products and services such as clean rooms, analysis and consulting services, and pseudonymous identifiers.
The Report’s key findings were that consumers lack awareness about data collection and use practices that are common across the industry, and it is unclear whether the privacy policies routinely offered by businesses provide them with the opportunity for truly informed consent, or meaningful control over ongoing data use. The Report also explores the possible consumer harms that arise at the intersection between security, privacy, and non-discrimination issues in the data space, with the ACCC reiterating calls for a prohibition on unfair practices in the Australian Consumer Law, a proposal that has already been endorsed in principle by the government.
As the data economy continues to expand, we have seen the rapid evolution of new business models that rely heavily on consumer data. The Report highlights the ACCC’s focus on ensuring that consumers’ personal information is used to foster innovation rather than to entrench market power or foreclose competition, and that data is collected and shared in a way that does not undermine consumer interests relating to privacy and security. Ongoing regulatory scrutiny should be expected for vertical dealings between data brokers, their business customers and end consumers, as well as M&A deals that involve the acquisition of data or analytical tools.
Summary of key considerations
Why is data collection a consumer issue?
The Report reiterates many of the consumer issues it has raised in earlier inquiries and market studies about the data industry. For instance, the ACCC discusses the potential harms that may arise if market segmentation data supplied by data firms allows their customer businesses to exploit vulnerable groups in targeted ways, or to discriminate in how they offer products or services to consumers. There are also concerns raised about how collecting data in increasingly large volumes poses a significant security risk, with data breaches potentially enabling the sharing and misuse of huge amounts of consumer information.
A notable point of focus for the ACCC in this Report seems to be the issue of privacy. The ACCC highlights a number of key ongoing privacy concerns that it considers insufficiently addressed by existing regulations, presenting these are further evidence to support the implementation of strengthened privacy laws in Australia.
What are the key privacy concerns posed by the practice of data collection, sharing and use?
The ACCC considers that existing privacy policies offered by data firms (but also other firms, such as digital platforms) lack the transparency and clarity to ensure that consumers are able to understand and knowingly consent to how their data is collected and used. However, the ACCC notes that transparency alone is not enough – consumers should also be able to exercise choice once they understand a certain firm’s privacy policy, in order to meaningfully control what data is collected from them and how it gets used.
The ACCC considers that this is currently not achieved by many data brokers. For example, it flags the use of ‘take-it-or-leave-it’ style agreements seeking bundled consents to complex or vague privacy policies, which enable firms to obtain unreasonable rights to use and share consumer data. These may lead consumers to unknowingly allow their data to be on-sold or provided to other firms for a broad range of barely-disclosed uses, such as targeted marketing to a personal address or phone number.
Additionally, the ACCC considers that all of these potential privacy harms are exacerbated by the growing risk that de-identified information will be re-identified as datasets are combined and data analytics technologies become more advanced. For example, the increasingly common practice of ‘data enrichment’ – which involves data being augmented with additional data from an external source – may lead to a combination of data points that allow an anonymised consumer to be identified. Although some data firms prohibit the re-identification of data, it can be difficult in practice to enforce this once data is passed into the hands of another party.
How might the government address these privacy and consumer concerns?
- Privacy law reform: the ACCC has consistently reiterated its support for the reforms recommended by the government’s Review of the Privacy Act, which we have previously outlined. The ACCC considers that this Report further emphasises the need for those reforms, as most of its privacy concerns would be best addressed through the strengthened privacy laws proposed by the Review (such as the introduction of a future right to erasure, or the creation of a ‘fair and reasonable test’ for personal information collection, use and disclosure). The government is anticipated to release draft legislation for these reforms in August this year – you can read more about the government’s response to the Review in our Insight here.
- Prohibition on unfair trading practices: another ongoing reform priority for the ACCC has been the introduction of a prohibition on unfair trading practices in Australia, leading the government to launch a consultation on possible reforms in August 2023. The ACCC contends that this Report provides further support for the introduction of such a prohibition, as it would better capture some of the harmful conduct flagged by the Report that may fall outside the scope of existing consumer law – for example, the use of complex ‘take-it-or-leave-it’ privacy policies by firms to access consumer data.
- Implementation of a data registry: the ACCC also suggests that the government could consider introducing a US-style registry for all data brokers that meet specified criteria, providing consumers with an accessible way to submit a single ‘do not collect’ or deletion request to all registered entities regarding data held about them.
How can data collection, sharing and use impact competition?
Data is a source of competitive advantage to data firms. By obtaining more data – either by investing in access to first-party proprietary data, or buying datasets from competitors – data firms can offer products and services with greater breadth, quality and volume. As a result, the Report considers how market dynamics may be impacted when data firms engage in conduct or dealings that affect access to data in some way.
Mergers & acquisitions in the data space
The ACCC observes a growing trend, both internationally and in Australia, of M&A deals that involve firms with access to datasets or data analytics capabilities. These firms may be acquired by:
- Data firms: several large M&A activities by data firms have been focussed on obtaining access to data and analytical tools, enhancing the data firm’s ability to extract valuable information from its existing datasets. These acquisitions may therefore affect competitive dynamics in data markets by enabling the data firm to expand their data products and services, or by directly absorbing a smaller data firm offering services to the same industries.
- Non-data firms: in some cases, data firms have been acquired by other companies that may collect first-party data or use data products and services. The parent company may then benefit from data-driven insights provided by the acquired firm, allowing it to compete more effectively in its main business(es). Additionally, the ACCC observes that data firms that are vertically integrated with a firm that is a source of data may have greater access to that data, providing opportunities to leverage the direct relationships held by the parent company. Therefore, vertical mergers may also provide a competitive advantage for the acquired data firm by increasing access to high-quality data.
Vertical foreclosure risks
The ACCC considers that data firms may have incentives to restrict access to unique datasets by other data firms that provide similar products or services. A data firm may be able to implement restrictions by entering into an exclusivity arrangement with a data supplier, prohibiting them from providing certain datasets to the data firm’s competitors. Similarly, a data firm may obtain exclusive access by acquiring or entering into a joint venture with a data source or agent that would otherwise have supplied the same data to multiple competitors. Given that data can be a meaningful source of competitive advantage, the ACCC raises concerns that this type of behaviour by data firms may have the practical effect of foreclosing rivals in relevant markets, by limiting the accuracy of competing products/services or the ability of other data firms to develop a similar service.
How might data-related competition issues affect the ACCC’s regulatory approach?
The Report’s discussion of exclusivity agreements and data-related M&A deals indicates that the ACCC plans to closely scrutinise arrangements with a data access dimension, both those between various data firms as well as vertical dealings involving data and non-data firms. Beyond its Report, the ACCC has recently recognised data as a ‘critical commodity’ whose importance will ‘only increase with the rise of artificial intelligence’. It is clear that the ACCC will be paying close attention to dealings involving data firms to assess how they may generate data advantages for the parties, and how this might go on to impact market dynamics more broadly. This focus may prove to be quite significant in the context of upcoming reforms to strengthen Australia’s merger clearance regime – more acquisitions are likely in future to be subject to the ACCC’s assessment process, during which it will directly engage in these exact kinds of competitive analyses.
Tensions between competition / consumer benefits and privacy
While the ACCC considers it important to promote competition in data markets, it recognises that there may be tensions between that goal and the pursuit of improved privacy outcomes for consumers, a key priority throughout its Report. For instance, remedies to address the ACCC’s competition concerns may involve data-sharing arrangements to prevent vertical foreclosure, or measures granting data firms fair, reasonable and non-discriminatory access to certain competitors’ datasets to ensure they have the necessary inputs to supply products and services to their customers. However, opening up data access in this way may come at the cost of protecting consumers’ interests relating to the collection, use and disclosure of their personal information to the greatest extent.
Importantly, promoting competition in data markets can also generate consumer benefits. Greater competition between data firms will generally mean businesses can access cheaper, better quality and more innovative data products and services. This can lead to a range of positive outcomes for consumers – for example, it may make advanced targeted advertising more accessible to smaller businesses, allowing them to better reach the audience that might be most interested in their products or services and leading to greater choice for those consumers. Therefore, when developing an appropriate regulatory framework for data markets, the ACCC acknowledges that these potential benefits may sometimes need to be weighed against the desirability of heightened data privacy and control for consumers.
The ACCC acknowledges that effectively navigating this nexus between competition policy and privacy regulation will require coordination from various regulatory agencies – in particular, the Australian Communications and Media Authority, the Office of the Australian Information Commissioner (OAIC), and the eSafety Commissioner. In 2022, the ACCC formalised existing collaborative arrangements with these agencies to form the Digital Platform Regulators Forum, facilitating greater engagement on cross-cutting issues. The ACCC and OAIC are also parties to an ongoing Memorandum of Understanding to encourage cooperation in developing and operating the Consumer Data Right. In a similar vein, the ACCC will likely seek to collaborate with these agencies to strike the appropriate balance between the various consumer issues arising in the data space, in order to develop a cohesive and practical regulatory response.
What does this mean for businesses that collect or share consumer data?
The Report makes clear that scrutinising ‘data broker’ businesses from a competition and consumer perspective will remain an ongoing regulatory priority in Australia, with increasing inter-agency engagement by the Digital Platform Regulators Forum on the intersecting issues raised by data collection, sharing and use across a range of industries.
Businesses should expect the ACCC to remain active in this space, with special focus on scrutinising data mergers & acquisitions and investigating potentially restrictive data sharing/selling arrangements between firms. The ACCC will likely also continue strongly advocating for consumer law reform to enhance protections against unfair data-related practices, especially targeting digital platforms with direct access to vast amounts of diverse and granular consumer data. However, it is also worth keeping in mind - as noted by this Report - that the ACCC can use existing provisions of the Australian Consumer Law to target some of its concerns with privacy policies and user agreements, such as the sections relating to false or misleading statements and unfair contract provisions.
The regulatory framework applying to businesses in the data space is constantly evolving, as lawmakers seek to keep pace with the rapidly developing technologies that are transforming Australia’s economy. You can stay up to date with this dynamic environment through our easy-to-use tech reg tracker, which is frequently updated with important developments across key areas of tech-related regulation.
If you would like to talk you through these developments, please reach out to our KWM contacts below.
