Legal Insights

Technology and data

By Sonia Sharma, Tara Dhanushkoti & Rishi Chhugani

• 07 February 2024 • 9 min read

Competition and consumer issues relating to digital platforms have continued to be a key enforcement priority for the ACCC over 2023. Last year, the ACCC focused on examining the significant consumer harm resulting from the lack of competition in the social media space, the lack of adequate safeguards against scams and the ever-increasing expansion of large digital platforms through their growing product and service offerings. Together with the Office of the Australian Information Commissioner (OAIC), it oversaw developments in the Consumer Data Right (CDR) regime with new rules being implemented for business consumers and a focus on improving the efficacy of the regime.

The ACCC has also continued to apply its ‘no wrong door approach’ in some areas, working collaboratively with other regulators, to ensure consumers can find the answers and support they need wherever they report or make complaints. The ACCC pursued several enforcement actions through the Courts, with several millions of dollars in penalties being awarded against businesses for a range of contraventions of law.

2023 enforcement priorities

The ACCC was vocal with its concerns regarding the competition and consumer issues linked to the expansion of the ecosystems of large digital platforms. In addition, it is concerned with the unfair and deceptive practices employed by many digital platforms such as those at the centre of its allegations against Meta and its subsidiaries regarding misleading and inadequately disclosed commercial data collection practices. As part of its ongoing Digital Platform Services Inquiry (Inquiry), the ACCC focused on ‘take-it-or-leave-it’ terms and ever-expanding data collection points in the growing ecosystems of large digital platforms.

Major developments and activities

Key developments in the CDR regime

In 2023, we saw further the development of the CDR regime, which was first established by the Australian Government in 2019. Key changes include:

Data Quality in the CDR regime

The ACCC (which administers the regime) published its findings on the regime’s data quality based on stakeholder consultation finding that there were shortcomings in the quality of product reference data and concerns over timely and satisfactory responses from data holders regarding data quality issues. Further, greater clarity was needed on obligations surrounding data quality and a stronger regulatory approach was required to improve data quality. Consequently, the ACCC has committed to having a stronger regulatory presence, providing clarification on participants’ obligations, and engaging with stakeholders to improve data quality and processes.

New CDR rules introduced for business consumers

The Competition and Consumer (Consumer Data Right) Amendment Rules (No.1) 2023 introduced new rules applicable to CDR business consumers. CDR business consumers have available to them two new functionalities that are not available to individual CDR consumers: specifically, the ability to share their data with unaccredited third parties and give certain use and disclosure consents for a period of up to 7 years (up from the usual 12-month maximum).

ACCC/OAIC Compliance and Enforcement Policy for the CDR regime

In October 2023, the ACCC and the OAIC released an updated Compliance and Enforcement Policy for the CDR regime. The updated policy sets out the regulators’ general approach to compliance and enforcement of the CDR, including their priorities. The changes to the policy reflect the maturation of the CDR regime by expanding the list of ‘priority conduct’ against which the ACCC and OAIC are more likely to take action. The regulators have clarified that they will be focussed on conduct that is likely to result in significant detriment to consumers and the integrity of the CDR regime.

Digital Platforms continue to face increasing scrutiny from the ACCC

The ACCC released its sixth interim report, dealing with social media and seventh interim report, dealing with digital platform ecosystems from the Inquiry in 2023. The Inquiry follows the ACCC’s 2019 Digital Platform Inquiry Final Report and is examining digital platform services, digital advertising services and data services.

Social Media

The social media report highlighted the harm to consumers and small businesses occurring through social media services. In particular, the report emphasised the excessive data collection practices, lack of effective dispute resolution options, the prevalence of scams, lack of transparency for advertisers and inadequate disclosure of sponsored content by influencers and brands.

Key findings and observations from the social media report include:

social media platforms do not have adequate safeguards to prevent scams, and the growth of influencer marketing raises concerns regarding the lack of disclosure of sponsorship or endorsements
Meta’s significant market power means that Facebook and Instagram are not competitively constrained by the entry of competitors (such as TikTok)
limited competition in social media means that consumers are forced into ‘take-it-or-leave-it’ terms and conditions, resulting in unwanted data collection and excessive advertising.

The ACCC has flagged the need for regulatory reform for social media services, including specific mandatory processes for consumers and businesses to report, and platforms to remove, scams and fake reviews. In addition, the ACCC continues to recommend that economy-wide measures be implemented (including for unfair trading practices) and additional, targeted competition measures and obligations for digital platforms.

"Social media services are an essential part of our daily lives and have provided many benefits to society. But we are concerned about the level of influence social media platforms hold over users and their position as critical intermediaries for businesses to reach customers. Limited competition in these services can lead to poorer outcomes for consumers and small businesses"

ACCC Chair, Gina Cass-Cass-Gottlieb

Expanding ecosystems of digital platforms

In its ecosystems report, the ACCC examined the need for new competition and consumer laws to address the expanding ecosystems of digital platforms. The report examined the strategies of Amazon, Apple, Google, Meta and Microsoft, and found that their expanding reach into the daily lives of individuals (through vast interconnected product and service offerings) was aggravating risks of harm to competition and consumers. The report also examined smart home devices and consumer cloud storage (as examples of ecosystems) to explore the impacts of the expansion of digital platform service providers.

Key findings and observations from the ecosystems report include:

Digital platforms with significant market power could bundle or self-preference their vast ecosystem of products to limit consumer choice and deter innovation from competitors.
As digital platforms expand their ecosystems, they have greater access to rich consumer data, resulting in consumers using multiple products from a single digital platform (often for ‘convenience’ and ‘interoperability’) and are being forced to consent to unfavourable terms and/or excessive data collection practices.
To further strengthen their position in the market, the five largest digital platforms are making significant investments in research and development and acquiring smaller companies in emerging technologies, such as generative AI and virtual reality.

The ecosystems report built on and reinforced the recommendations made in the ACCC’s fifth report, released in September 2022, which dealt with the need for regulatory reform. We commented on this report in our ACCC 2022 in Review.

"Consumers who use multiple products from a single digital platform may be forced to agree to unfavourable terms and conditions and/or accept unpalatable data collection practices due to a lack of suitable alternatives or because it is simply too inconvenient or costly to move out of that ecosystem"

ACCC Chair, Gina Cass-Cass-Gottlieb

Data broker industry – community concerns

In 2023, the ACCC invited consumers, businesses and interested stakeholders to provide submissions about data broker services as part of its eighth interim report under the Inquiry, the results of which are due in March 2024. As per the issues paper released in July 2023, the ACCC is investigating the lack of transparency and awareness of how data brokers collect personal information, including sensitive personal information, from a range of sources across the internet, loyalty programs, card payment providers, electoral rolls and public records. The eighth report will focus on how the collected information is shared or sold with third parties without adequate disclosure or consent from individuals.

Beware of privacy and ACL obligations when handling personal information

Noting the context of the 2022 Medibank cybersecurity incident, the ACCC emphasised the importance of insurers and other businesses being alive to their privacy and ACL obligations in the context of building on existing and developing new wellness apps and rewards programs, and ensuring transparency about the handling of consumer data (especially personal information).

Looking ahead

The ACCC’s continuous focus on digital platforms is bound to increase, as they play an ever-increasing role in society and continue to create and perpetuate competition and consumer issues. In particular, we envisage that as the reforms to the Privacy Act 1988 continue to develop over 2024, the ACCC will take more enforcement actions, continuing to critically examine the data handling practices of digital platforms and other players in the digital economy for misleading and deceptive conduct.

The collection and use of data by digital platforms are going to continue to be under the spotlight of several regulators operating in this space, including the ACCC, OAIC and ACMA. As such, all organisations must take proactive steps to maintain the digital trust of consumers. To do this, we recommend that organisations consider taking the steps set out in our previous article concerning the proposed changes to the Privacy Act 1988.

In 2022, the ACCC also instituted proceedings in the Federal Court against Meta for engaging in false, misleading or deceptive conduct by publishing scam advertisements. These scam ads were about investing in cryptocurrency and money-making schemes and featured prominent Australian public figures. Meta unsuccessfully applied for these civil proceedings to be stayed whilst separate criminal proceedings were on foot (with the Federal Court dismissing the application in October 2023). Whilst there were few substantive movements in the case in 2023, commentary from the Federal Court suggests that the civil proceedings will not proceed to a final hearing until late 2024 at the earliest.

Finally, with several regulatory changes being proposed by the ACCC for online marketplaces, social media and digital platforms, and the Federal Government generally agreeing to these recommendations, we can expect several potentially significant changes to the regulatory framework in the coming years. No doubt the ACCC will continue to agitate for a market-wide ban on 'unfair practices' based on its findings in the Inquiry.