Transcript
Check transcript against delivery
Acknowledgement of country
I wish to acknowledge the Traditional Custodians of the land we are meeting on today, the Gadigal people of the Eora Nation.
I pay my respects to them and their cultures and to their Elders past, present and emerging. I acknowledge their continuing connection to the land, sea and community.
I would also like to acknowledge and pay my respects to Aboriginal and Torres Strait Islander people who are attending today’s event.
Introduction
Thank you for having me here tonight.
Digital platforms are some of the most valuable companies in the world. They are critically important to consumers and businesses, and are major enablers of activity in our economies. They provide a critical and highly topical demonstration of Regulatory intersections between competition, consumer and privacy laws.
As you would all know, data is the key currency of many digital platforms. Consumers often pay in data to use these services and it’s collected, aggregated, and monetised by digital platform services. In doing so, these platforms build richer data sets about individual consumers.
However, in the six years that the ACCC has been looking at digital platform markets, it’s become clear to us that digital platforms’ data practices can raise significant competition and consumer issues which often intersect with privacy law.
I know this will resonate with many of you, as regulators around the world are being called upon to address novel issues arising from these intersections.
Tonight, I would like to speak about the ACCC’s work on digital platforms, and the issues we are confronting in relation to intersection between competition, consumer protection and privacy.
I will also touch on how we work with other regulators to address these intersecting issues, both internationally and domestically as part of Australia’s Digital Platform Regulators Forum.
The intersections between competition, consumer protection and privacy
The ACCC’s work on digital platforms
The ACCC has been looking at digital platform markets since 2017.
First, we examined their impact on news and journalism content and advertising services markets in the Digital Platforms Inquiry. In 2020 and 2021, we considered the supply of digital advertising technology and agency services through the Ad Tech Inquiry.
More recently, as part of our ongoing five-year Digital Platform Services Inquiry (DPSI), we’ve looked at a range of services, including search, app stores, online private messaging services, electronic marketplaces, social media and the expanding ecosystems of digital platforms.
During each phase of our work, we’ve identified a range of concerning conduct, including in relation to platforms’ use of data. We’ve observed how this conduct can harm competition and consumers as well as raise significant privacy concerns.
I’d like to take a few minutes to step through how the ACCC has seen all these issues intersecting during our digital platforms work.
Intersections between consumer protection and privacy
The OAIC's recent Australian Community Attitudes to Privacy Survey 2023 confirmed that privacy is the third most important factor amongst Australians when choosing a product or service, coming only after quality and price.
That survey also found that 84% of Australians surveyed wanted more control and choice over the collection and use of information. Research by the Consumer Policy Research Centre has found that 84% of Australians consider that companies should keep their personal information safe.
Despite this, the ACCC has previously found consumers of digital platforms services are generally not aware of the extent to which their data is collected, nor how it is collected, used and shared. This is influenced by the length, complexity and ambiguity of businesses’ terms of service and privacy policies, many of which contain vague statements such as ‘we may share your data with trusted third parties,’ with little or no information available as to who these third parties are.
If businesses misrepresent their data collection and usage practices to consumers, this may lead consumers and other businesses to underestimate the potential harm that could arise from a data breach or other misuse of their data. In turn, such problems may reduce consumer trust in data-driven innovations and limit the benefits the digital economy can bring.
Lack of transparency about how digital platforms collect, use and share consumers’ information may not only raise privacy concerns, but in Australia, may also constitute misleading or deceptive conduct under our consumer laws.
For example, in July this year, following enforcement action brought by the ACCC, the Australian Federal Court ordered two subsidiaries of Meta to each pay $10 million for misleading Australian consumers about how their data would be used when promoting Meta’s Onavo Protect mobile app.
Onavo Protect, a free app providing a virtual private network (VPN) service, was promoted as a product that would keep users’ data protected and safe, for example with language such as “Use a free, fast and secure VPN to protect personal information” and “Helps Keep You and Your Data Safe”.
In fact, the developers and suppliers of Onavo Protect shared the personal activity data from users with their parent company, Meta. This included anonymised and aggregated data about users’ internet and app activity, such as records of every app they accessed and time they spent using those apps. This data was used to support Meta’s market research activities.
The ACCC took this case knowing that many consumers are concerned about how their data is captured, stored and used by digital platforms. We believe Australian consumers should be able to make an informed choice about what happens to their data based on clear information that is not misleading.
In the case of the Onavo Protect app, the ACCC was concerned that consumers seeking to protect their privacy through a virtual private network were not clearly told that, in downloading and using this app, they were actually facilitating the use of their data for Meta’s commercial benefit.
The ACCC will continue examining the intersections between consumer protection and privacy as we continue our Digital Platform Services Inquiry.
We are particularly mindful of these overlaps as we prepare our upcoming 8th interim report of the DPSI, where the ACCC is considering a range of potential competition and consumer issues relating to the data-driven products and services supplied by data brokers in Australia.
The report, which is due to the Australian Government in March next year, will focus in particular on the activities of data broking businesses which obtain personal and other information on Australians from third parties, rather than directly from consumers themselves.
Intersections between competition and privacy
In digital platform markets, there are also significant intersections between privacy and competition.
Access to vast amounts of high-quality user data has provided a considerable competitive advantage to established platforms, which can use this data to train algorithms and offer improved and personalised services.
As digital platforms expand into new markets – artificial intelligence, health services, information storage, and financial products, to name a few – they benefit significantly from the opportunity to combine user data, including consumers’ personal information, collected across services to build more detailed user profiles
Earlier this week, the ACCC published our 7th Digital Platform Services Report on competition and consumer issues arising from expanding digital platform ecosystems.
As digital platform service providers create new products and services across different sectors, consumers risk losing control over their information. Terms of use and other privacy policies that outline digital platform data collection and use practices are often complex, opaque and not user friendly.
In addition, consumers do not always read all the terms and conditions (including privacy policies) associated with a digital platform service. Even those that do may agree to unfavourable terms and conditions due to a lack of effective competitive alternatives or because of the perceived importance of maintaining access to digital platform services.
As a result, consumers may face difficulties with controlling how their data is collected and used across services which may be heightened as digital ecosystems continue to expand. This also creates difficulties anticipating all the ways that data may be re-used in the future, as further uses may be discovered through the creation of new services.
These data-related factors also increase barriers to switching and contribute to high barriers to entry and expansion in digital platform markets and increase the potential for harm to competition.
A lack of competition can potentially reduce a firm’s incentive to build strong privacy protections, leading to excessive collection of consumers’ personal data. This may in turn increase the risk of harm arising from scams or data breaches in cases where a platform fails to have adequate data protection and privacy measures in place.
ACCC’s regulatory reform recommendations
In September last year, the ACCC provided our fifth interim report of the Digital Platform Services Inquiry, which made recommendations to the Australian Government for significant regulatory reforms to better promote competition and protect consumers in digital platform markets. If adopted, we anticipate that our recommended reforms would help to more closely align platforms’ data handling practices with the expectations of consumers.
The Government has conducted a public consultation on our recommendations, and we eagerly await its public response.
Coordination with other regulators
Given all of these intersections, it is clear that competition, consumer and privacy law authorities have shared interests. We also face similar challenges in progressing policy interests and enforcing laws in these emerging markets.
The intersection of these laws presents significant opportunities for the development of cooperative strategies between regulators, particularly in relation to digital platform regulation.
ACCC ongoing international cooperation – ICN Intersection Project
In the international arena, the ACCC co-leads, alongside the AGCM (Italy’s competition authority), CCB (Canada’s competition authority) and the US FTC, the International Competition Network (ICN) project (which was launched in 2020), on “Competition law enforcement at the intersection between competition, consumer protection, and privacy.”
Through this project, the ACCC is working collaboratively with agencies to:
- Increase the understanding of ICN members of how their fellow agencies consider issues which lie at the intersection of competition, consumer and privacy law enforcement, and
- Share knowledge and expertise developed by ICN members in dealing with these issues.
The Intersection Project Group is in the process of finalising an agency considerations handbook that authorities can refer to when dealing with data and privacy intersection issues in competition enforcement work. This handbook will identify the different relationships that may exist between competition and privacy policies and will propose a checklist of issues and questions for the competition agency to consider in assessing the privacy and competition relationship in any conduct enforcement, merger, remedy, or policy matter.
When privacy and competition policies conflict, jurisdictions may weigh these values differently in assessing the trade-offs. While recognising jurisdictional differences, the handbook will provide several principles for consideration, to foster inter-agency coordination. It is intended to be a ‘living’ document, recognising that these issues are always evolving and new examples from country experiences are continuously arising.
We were grateful for the OAIC’s input, along with input from other global privacy agencies, on a draft of the agency considerations handbook earlier this year.
I understand the Global Privacy Assembly’s (GPA) Digital Citizen and Consumer Working Group (DCCWG) is also studying the intersections between privacy and data protection, consumer protection and competition, and commissioned a report by Erika Douglas titled ‘Digital Crossroads: The intersection of Competition Law and Data Privacy’. The report rightly identifies that the intersection is a rapidly evolving area of law and policy that demands attention and cooperation across agency bounds to develop cohesive, effective digital enforcement strategies.
The collaborative work produced by these multi-jurisdictional groups highlights the emerging global consensus that privacy is an important parameter of competition, especially in the digital platform economy, and continued cross-doctrinal cooperation will be essential to achieving cohesive and effective digital regulation.
We encourage your contributions, as privacy authorities, to this important work.
DP-Reg
At home in Australia, the Digital Platform Regulators Forum, or DP-Reg, was formed in March 2022 as an information sharing and collaboration initiative on the regulation of digital platforms.
Members of DP-Reg include the ACCC, the Australian Communications and Media Authority, that Office of the Australian Information Commissioner, and the Office of the eSafety Commissioner. Separately, these agencies have regulatory responsibility for competition and consumer protection, media and broadcasting, data and privacy protection and online safety respectively.
DP-REG was established in recognition of the fact that all four regulators involved face many of the same challenges.
These include:
- emerging online harms to Australians,
- encouraging innovation while balancing protections, and
- limiting detriment from the market power of these large, complex and diverse multinational entities.
An effective approach to the regulation of digital platforms requires collaboration and coordination given the need for complementary expertise to effectively address these challenges.
While all four regulators have traditionally worked closely together, the forum is allowing us to engage more closely to promote proportionate, cohesive and well-designed digital platform regulation. The DP-REG members do this through collaboration on research, capacity building and joined up engagement with stakeholders in relation to issues of common concern.
This also has clear benefits for industry in terms of minimising potential burden and unnecessary regulatory overlaps.
In terms of procedure, we aim to do this through frequent formal and informal consultation within the group – for example knowing the timing, content and stakeholders involved in an ACMA consultation process can ensure that the ACCC, OAIC or eSafety can take this into account when asking these same stakeholders to participate in our work. It also means we are aware of upcoming streams of work, such as privacy and communications consumer surveys and, rather than repeat this work, we can leverage off it to inform our work.
The forum also benefits other parts of government and industry stakeholders by providing opportunities to streamline their engagement with its member regulators. For example, they can meet with and present to members collectively rather than separately.
Sharing information and developing common understandings of technologies, business models and concepts between regulators may also reduce the scope of direct information requests to industry.
In terms of the regulatory issues DP-REG is examining, our key priorities for 2023-24 include assessing the impact of algorithms, improving digital transparency, and increasing collaboration and capacity building between members. Given recent developments related to generative AI, DP-REG is also continuing to focus on understanding and assessing its benefits, risks and harms, and how this technology intersects with the responsibilities of each member.
While DP-REG is still a relatively new initiative, it has already undertaken a range of useful projects and activities.
For example, DP-REG has:
- drafted working papers examining generative AI large language models, and on the risks and harms associated with algorithms such as recommender systems, targeted advertising and content moderation;
- made joint submissions to an Australian Senate Committee inquiry into the influence of international digital platforms as well as a recent Government consultation on responsible use of AI; and
- held inter-agency workshops on digital technologies and best-practice approaches to code development.
Market participants in the digital platform industry include the some of the best-resourced and technologically sophisticated firms in the economy. It will always be difficult for individual Australian government regulators to keep pace, so it’s extremely useful to be able to share knowledge and resources through initiatives like DP-REG.
We have also been following recent international developments relevant to cooperative strategies between domestic regulators with interest, including the UK’s Digital Regulation Cooperation Forum, which supported the development of Australia’s own Digital Platform Regulators Forum. I understand you will hear more on these developments from our international colleagues tomorrow.
Conclusion
In closing, I would like to note the ACCC’s commitment to continue collaborating at home with the OAIC and our fellow Australian regulators and decision-makers. We are also a strong supporter of international cooperation and experience first-hand the importance of working together closely. We have entered into several memorandums of understanding with various regulators and also cooperate informally in various forums including the OECD, ICN and other bilateral and multilateral platforms. We are open to working with, and learning from you that are here tonight.
Together we can make great strides in navigating the challenges arising from the evolving technologies that are impacting the way we do business and experience life as consumers.
Thank you for your time, and I again look forward to opportunities to discuss further cross-jurisdictional strategies to address shared challenges facing competition, consumer protection and privacy regulators.