ACCC Digital Platforms Report recommends significant changes to Australian privacy laws

Eighteen months after receiving its terms of reference from the Commonwealth Government, the ACCC has released a wide-ranging report into digital platforms such as search engines and social and digital media platforms. Although triggered by concerns about competition in media and advertising services markets, the scope of issues covered by the report reflects the pervasiveness and impact that these technology companies have had.

The ACCC made a number of findings including that:

• Key platform providers occupy a critical position in the digital economy, and have significant market power in Australia;
• There is a lack of transparency in online advertising markets;
• There is regulatory disparity between some digital platforms and more heavily-regulated traditional media;
• Shifts in advertising expenditure mean that some kinds of journalism may be at risk of under-provision in Australia;
• Accessing news and journalism through digital platforms may increase consumers’ risk of exposure to less reliable and lower quality news; and
• Digital platforms collect a large range of information about users, and that current privacy and consumer laws may be inadequate to deal with this.

As a result of these findings, the ACCC has made a large number of recommendations, which touch on a wide range of areas of law, including competition law, merger approvals, media regulation, copyright law, taxation, consumer law, privacy law, and even school curricula. In many instances, these changes would have a significant impact beyond just the context of digital platforms.

Amongst some of the more significant reforms, if adopted, would be changes to the Privacy Act with broad application. Some of these changes echo reforms already mooted by the Attorney-General for adoption later this year, but many would go significantly further. Of particular interest are suggestions to:

• Broaden the definition of “personal information”, to ensure that it is clear that the Privacy Act applies to digital identifiers like IP addresses, and to information that might be inferred from data collected;
• Introduce more robust obligations about when consent is required from individuals, and what qualifies as effective consent, including by ensuring that individuals cannot be “opted-in” by default;
• Allow individuals to directly bring action for breaches of the Privacy Act, rather than relying solely on enforcement by the Office of the Australian Information Commissioner;
• Provide individuals with the right to request erasure of their information;
• Introduce a statutory tort for serious invasions of privacy; and
• Consider other aspects of the Privacy Act, including potentially removing exceptions for small businesses, employers and political parties, and strengthening laws to align with jurisdictions with robust privacy regimes, such as the European Union.

The Treasurer has announced that the Government is reviewing all of the ACCC’s recommendations, and is engaging in a public consultation process concluding 24 October 2019, and that “[t]he precise form of the reforms and a Government response to the report’s 23 recommendations will be informed by this consultation process”.

While it remains to be seen whether any of the particular measures discussed above will be adopted by Parliament, the Attorney-General’s existing statements on privacy law suggest that change is on the way.

HWL Ebsworth will continue to monitor the position and report on further developments.

This article was written by Peter Campbell, Partner and Daniel Kiley, Special Counsel.