ACCC v Google - what you need to know now
The ACCC has instituted proceedings against Google LLC and Google Australia Pty Ltd alleging the tech giant engaged in misleading conduct and made false or misleading representations to consumers about the personal location data Google collects, keeps and uses.
It’s all over the news. The ACCC has instituted proceedings (Google Proceedings) in the Federal Court against Google LLC and Google Australia Pty Ltd (together, Google), alleging the tech giant engaged in misleading conduct and made false or misleading representations to consumers about the personal location data Google collects, keeps and uses.
The ACCC claims that from at least January 2017, Google breached the Australian Consumer Law when it made on-screen representations on Android mobile phones and tablets that the ACCC alleges misled consumers about the location data Google collected or used when certain Google Account settings were enabled or disabled.
'We are taking court action against Google because we allege that as a result of these on-screen representations Google has collected, kept and used highly sensitive and valuable personal information about consumers' location without them making an informed choice,' ACCC chair Rod Sims said.
The Google Proceedings come hot on the heels of the ACCC’s case against HealthEngine (HealthEngine Proceeding). In the HealthEngine Proceeding, the ACCC is alleging that HealthEngine, which runs a medical appointment booking app, misled consumers by collecting personal information for the purpose of providing the medical appointment service but also passing on that personal information to law firms seeking clients for personal injury claims. In other words, misleading consumers about what they were doing with their personal data.
The ACCC is sending a crystal clear message to the market: don’t mislead consumers about the way in which you use their personal data. In privacy terms, this is known as ‘functional creep’, collecting personal information for one purpose and using it for another entirely different purpose (and not being open and transparent about that).
The ACCC has come out swinging when it comes to privacy related matters in a way the Office of the Australian Information Commissioner (OAIC) has not been able to do in regulating the Privacy Act (likely due to a number of factors, including resourcing).
In our view, the ACCC’s Google Proceedings and HealthEngine Proceedings, together with the ACCC’s 600+ page Digital Platform Inquiry, signal a new era of consumer-focused privacy reform in Australia where compliance with the Privacy Act is not going to be the end of the story when it comes to the collection and use of personal information.
In order for organisations to stay on the right side of the law and not mislead individuals about their personal information it is clear that organisations must:
- Take a ‘privacy by design’ approach and think about privacy at the start of a project. This is best done by conducting a privacy impact assessment which can assess the use of data and put in place adequate controls;
- Be open and transparent with individuals and consumers about how their personal information is being used – relying on bundled consent in privacy policies and collection statements for a secondary use and disclosure is increasingly becoming pretty risky given the ACCC’s actions;
- Don’t be creepy! To avoid misleading consumers about the way in which you use and disclose their personal information – be mindful of functional creep. Consider the reason why the consumer gave you their personal information in the first place and whether you are using their personal information for that purpose (again, conducting a Privacy Impact Assessment for new projects is crucial).
ACCC updates advertising and selling guide
By Laura Cantillon
The ACCC has updated its guidance to Australian businesses on what is required to ensure compliance with the ACL
Managing climate change-related risks in the financial system
By Patrick Ibbotson & Jessica Dorricott
Risks posed by climate change to the stability of the US financial system.
Franchisors, it’s time to update your disclosure documents
Key considerations when updating the franchising disclosure documents as per the Franchising Code of Conduct (Code).
GDPR decision slaps down Privacy Shield and imposes strict conditions on Standard Contractual Clauses – implications for Australian organisations
Impacts for Australian entities who are either directly subject to the GDPR or receiving personal data from the EEA.