Topics in this month’s briefing
- Review of the Australian Privacy Act
- ACCC Digital Supply Chain Review (Ad Tech Inquiry)
Review of the Australian Privacy Act
In Australia, the terms of reference for a review of the Australian Privacy Act are being finalised by the Federal Attorney General.
The usual way forward would be that the Government releases an issues paper and calls for submissions. We don’t know when this will happen, what the terms of reference will be, or how this review will be conducted.
We do know that the Federal Government will move forward on this review, and that uses and sharing of consumer data in targeted marketing will be a key area of focus.
Other areas likely to be in active consideration include:
- Operation of regulation of unfair contract terms and of other consumer protection, data privacy and spam restrictions in relation to uses and sharing of consumer data, and whether concerns as to allegedly excessive collection and sharing could be addressed through application of those restrictions, or whether privacy law needs to be expanded.
- Adequacy, specificity and intelligibility of privacy policies and just-in-time notices to consumers about specific data handling practices. The legal proceedings launched in the Federal Court by the ACCC against Google, Trivago, and HealthEngine are advance indications of much stricter requirements and active enforcement in this area.
- Circumstances in which consumer information is not regulated as personal information, and in particular whether all uses and sharing of cookies and other tracking code and online identifiers should be regulated as a use of personal information.
- Whether there should be specific no-go zones for targeted advertising: for example, prohibitions on targeted advertising to children or vulnerable people, or uses of credit/debit card usage data by loyalty scheme operators.
- The alleged need for new accountability and transparency requirements for any entity handling consumer attribute data, potentially going well beyond current notice and consent requirements under the Privacy Act. Current notice and consent requirements apply only to personal information about identifiable individuals, do not required affirmative express consent, and do not include restrictions upon automated decision making algorithms used to determine whether, how, at what price and on what terms, offers are made to individuals or segments of inferred like individuals. Consumer advocacy organisations are increasingly vocal as to a need for expanded privacy law restrictions in each of these areas.
- Working out an appropriate balance between regulatory prescription and industry self-regulation, and preconditions for industry codes of practice and other forms of self-regulation to operate to restrict or otherwise affect general regulatory requirements. There is increasing scepticism of Australian regulations towards industry self-regulation codes which do not have substantial enforcement ‘teeth’. If industry sectors are to keep alive a meaningful role for self-regulation, regulators are likely their active input and oversight, including as to investigations and enforcement.
- Whether individuals should have rights to complain and seek remedies in relation to alleged breaches of data privacy laws, or whether the Office of the Australian Information Commissioner (OAIC) should remain the gatekeeper of private rights of action.
What do Australian companies need to do now?
Publishers – if collecting data about users who are identified or readily identifiable, ensure full, reliable and verifiable separation of this data from collection and uses of online tracking code relating to (unidentifiable) users. Make sure that your privacy disclosures reflect your processes and practices.
Media Agencies, ad tech & data partners – review processes and practices for handling of customer attribute data and ensure that disclosures reliably reflect reality in both own practices and those of entities with whom customer data is shared. If handling purportedly deidentified data, make sure that staff understand relevant controls and safeguards and that they are such that possibilities of reidentification are minimised. Consider whether measurement and reporting practices reflect emerging good industry practice.
Advertisers – if using data about customers who are identified or readily identifiable, ensure full, reliable and verifiable separation of this data from collection and uses of online tracking code relating to (unidentifiable) users. Make sure that your privacy disclosures reflect your processes and practices.
The ACCC examines the digital advertising supply chain
As most readers will already know, the ACCC is now well advanced on an 18-month ‘digital advertising services inquiry’ focussing upon digital advertising services and advertising agencies[1]. The ACCC is undertaking market enquiries and reviewing about 40 submissions, with a draft report due for completion by 31 December 2020.
The report from this inquiry may recommend reshaping of regulation affecting placement, use and sharing of cookies and other online tracking code for targeted advertising. The ACCC may recommend that the Federal Parliament regulate for new transparency and reporting requirements, or effectively require industry to implement a binding code or comply with ACCC determined rules.[2]
The digital advertising services inquiry follows the ACCC’s Digital Platforms Inquiry[3] and the ACCC’s Customer Loyalty Schemes review[4]. The ACCC’s final reports from these inquiries were critical of what the ACCC considered was excessive collection and use of consumer data, including through tracking of consumer use of credit and debit cards. In the ACCC’s Customer loyalty schemes review, the ACCC recommended that “Coles, Flybuys and Woolworths Group should end the practice of automatically linking customers’ payment cards to their loyalty scheme profile to track their purchasing behaviour and transaction activities when they do not scan their loyalty card”.
The recommendations also included that loyalty scheme operators clearly state with which entities consumer data is being shared and for what purposes. This would include drawing to consumers’ attention how their data is being handled (such as by providing a prominent notice during relevant interactions with customers), disclosing to consumers the sources of third party advertising, the sources of the consumer data used to inform that advertising, and the channels through which consumer may receive targeted advertising and how data about them is being used to generate leads.
Carefully constructed regulation for improved transparency and accounting through the diverse and complex distribution advertising supply chains could facilitate mix and match strategies by marketers and media buyers. Careful regulation could promote diversity and competition in provision of adtech and martech services and in availability and offer of digital advertising canvas.
However, these is a real risk that the ACCC will recommend cranked up requirements for notice to and consent by consumers and restrictions on data sharing. Regulating on this way would be likely to reduce availability and sharing of customer attribute data, even in circumstances where the industry implements appropriate controls and safeguards to protect consumer privacy and for fair and transparent data use, avoids overly narrow targeting, and avoids excessive differentiation in prices and other terms offered to distinct segments of consumers. This outcome would reduce the ability of marketers, advertising agencies and supporting adtech and martech intermediaries, to control and direct targeted digital advertising through use of customer attribute data.
Another reasonably likely consequence of this type of regulation would be to encourage creation of ‘walled garden’ control of customer attribute data within some entities such as certain digital and mobile platforms, credit card schemes and some loyalty programs. This could reduce the range and value of alternative digital advertising canvas, concentrating the pricing power of these entities, and hollow out demand for services of providers of adtech and martech services. We already see moves by some large entities to differentiate their businesses and data handling as protective of consumer privacy, in some cases by denying other entities any use of customer attribute data, while actively increasing that same use within their own operations.
In summary, we don’t yet know how the ACCC will reshape digital advertising supply chains. Industry needs to actively assist the ACCC to understand the complexity of the digital advertising data ecosystem and the need for policy to be carefully designed. The Australian industry needs to collaborate and lead by developing proposals for industry codes that address fair and transparent data use and sharing and transparency and reporting in the advertising value chain.
What do Australian companies need to do now?
Publishers – consider how to accommodate measurement expectations of advertisers without excessive disclosure of identifying data. Check that contracts with other participants in the digital ad supply chain addressing uses of customer data reflect your published disclosures.
Media Agencies, ad tech & data partners – consider how to address ACCC concerns as to transparency and accounting through reporting. Ensure fee disclosures are fair and not misleading through rebates or other adjustments. Address minimisation of handling of consumer data and contracts and other controls and safeguards around data sharing.
Advertisers – look carefully at sources of data about individuals and whether the governance of that data is reliable. Consider sustainability of current marketing practices and possible alternative consumer opt-in or consent models, including loyalty programs and customer rewards. Verify that you know who controls what data.
Peter Leonard, Principal
Data Synergies
E pleonard@datasyngergies.com.au
[1] https://www.accc.gov.au/focus-areas/inquiries-ongoing/digital-advertising-services-inquiry.
[2] The ACCC is also conducting a continuing ‘Digital platform services inquiry 2020-2025’ which will further develop regulatory initiatives addressed in the ACCC’s 2019 Digital Platforms Inquiry Final Report: see https://www.accc.gov.au/focus-areas/inquiries-ongoing/digital-platform-services-inquiry-2020-2025
[3] https://www.accc.gov.au/focus-areas/inquiries-ongoing/digital-platforms-inquiry
[4] https://www.accc.gov.au/focus-areas/market-studies/customer-loyalty-schemes-review
Other resources of interest:
OAIC 2020 Australian Community Attitudes to Privacy Survey
OAIC 2020/2021 Corporate Plan and Priorities