Consumers generate data in almost all aspects of their lives as many activities that were once anonymous are now subject to detailed data collection, such as restaurants that require customers to order via a QR code and input personal details.
The latest Digital Platform Services Inquiry report published today, highlights that consumers are generally unaware how much of their data is collected, used and shared with data firms and other businesses.
“Data is a critical commodity in today’s economy as it helps businesses create innovative products and tailor new services for consumers. Its importance will only increase with the rise of artificial intelligence,” ACCC Deputy Chair Catriona Lowe said.
“This report shines a light on a relatively unknown part of the data ecosystem and examines the data products and services supplied by data firms. In many cases, the data firms do not have a direct relationship with the consumers whose data may be used.”
Data firms collect consumer data from a range of online and offline sources and use it to create and sell data services to business customers across many industries for a variety of purposes. These services include data-driven marketing and advertising, risk management, such as identity verification and fraud detection services, and property data and analytics services.
Long and complex privacy policies that use ambiguous language or ‘take-it-or-leave-it’ terms make it difficult for consumers to understand, intentionally consent to and control what happens to their data, the ACCC has found.
The report observes that data collection practices do not align with consumer expectations, based on a 2023 consumer study which found that 74 per cent of Australians are uncomfortable with their personal information being shared with or sold to other companies.
“Many consumers may be unaware of the scope of data that is collected and then shared or on-sold to other data firms or unidentified third parties,” Ms Lowe said.
“As consumers are increasingly required to provide personal information or other data on themselves to access important services, such as applying for a rental property or receiving an insurance quote, we are very concerned that consumers may be unable to exercise choice or meaningful control over how their data is shared and used.”
Examples of data that may be held about consumers
While data firms’ products and services often use de-identified data, the ACCC is concerned about the growing risk of consumers being re-identified as datasets are combined with additional data points.
The report also highlights the potential identification and targeting of vulnerable consumers when consumers are categorised into groups to enable businesses to identify potential customers. For example, a consumer segment that identifies people as ‘frequent gamblers’ may be used to advertise gambling products to people who have a gambling addiction.
The ACCC continues to support reforms to strengthen privacy laws to empower consumers to control and protect their data and the introduction of an across the economy unfair trading practices prohibition to address potential consumer harms.
Potential incentives to restrict access to data
In addition to the potential harms arising from the misuse of consumer data, the ACCC has observed that data firms have potential incentives to harm competition by placing contractual obligations in agreements with business customers or data suppliers that limits a competitor’s access to data. This may foreclose rivals, especially in industry sectors where only a small number of data firms offer services.
The report also observes that mergers and acquisitions by data firms are frequent and are often a tool used to broaden the portfolio of a data firm’s products and services but can provide the acquirer with the ability to restrict access to important datasets.
Regulatory reform recommendations
This is the eighth report in the ACCC’s five-year Digital Platform Services Inquiry.
In the fifth report of the Digital Platforms Services Inquiry, the ACCC made a range of recommendations to bolster competition in the digital economy, level the playing field between big tech companies and Australian businesses, and reduce prices for consumers.
The recommendations include new service-specific mandatory codes of conduct for particular ‘designated digital platforms,’ based on principles set out in legislation.
This new regulatory regime would work alongside Australia’s existing competition laws to address anti-competitive conduct, unfair treatment of business users and barriers to entry and expansion by potential rivals.
The ACCC has also proposed new mandatory obligations on all digital platforms to address scams, harmful apps, fake reviews, including notice and action requirements and stronger verification of business users and reviews.
These proposed measures have been agreed to in principle by the Government.
Notes to editors
Many firms which operate in Australia’s data ecosystem do not characterise themselves as ‘data brokers’ and instead use terms such as ‘data analytics business’, ‘data analytics or data enrichment firm’ and ‘data collaboration platform’, or state they offer data-based ‘tools’, ‘insights’ or ‘data analytics services.’ The report uses the term ‘data firms’ to collectively describe the firms supplying the data products and services being considered.
The report found there has been an evolution in the nature of the supply of data products and services and in the types of firms that supply those services. The industry has expanded beyond more ‘traditional’ data products and services, such as those that enable businesses to purchase, sell or exchange personal information, to incorporate a broader array of data products and services. Given this evolution, what may have been typically understood by the terms ‘data broker’ and ‘data broking’ may not fully capture the suppliers and the products and services that are important parts of the modern Australian data ecosystem.
De-identification refers to the process of transforming personal information into information that is no longer about an identifiable or reasonably identifiable individual. The use of de-identified data may have some benefits for consumers’ privacy.