Digital Platforms Inquiry

A specialist digital platforms branch be established within the ACCC to build on and develop expertise in digital markets and the use of algorithms, with the purpose of:

• proactively monitoring and investigating instances of potentially anti-competitive conduct and conduct causing consumer harm by digital platforms, which impact consumers, advertisers or other business users (including news media businesses)

• taking action to enforce competition and consumer laws relating to the conduct of digital platforms

• conducting inquiries and making recommendations to Government to address consumer harm and impediments to the efficient and effective operation of the markets in which digital platforms operate, caused by market failure.

This branch should be empowered by Ministerial direction to hold an extended public inquiry covering a period of at least five years and have the ability to compel relevant information.

Recommendation 5: Inquiry into ad tech services and advertising agencies

The specialist digital platforms branch (as proposed by Recommendation 4) be directed to hold an inquiry into competition for the supply of ad tech services and the supply of online advertising services by advertising and media agencies. Matters to be taken into account should include:

• whether a lack of transparency is impacting the efficient operation of these markets

• the prices charged by suppliers of these services and the share of advertising expenditure they retain (including whether any potential excessive margins are obtained)

• how these services are purchased and sold, including any auction and bidding processes

• the relationship between suppliers and customers of these services, including the extent to which company structures or contractual arrangements limit effective competition

• the impact of consolidation of services on competition.

This inquiry should be empowered by Ministerial direction, have the ability to compel relevant information, and be completed over a period of 18 months.

Recommendation 6: Process to implement harmonised media regulatory framework

A new platform-neutral regulatory framework be developed and implemented to ensure effective and consistent regulatory oversight of all entities involved in content production or delivery in Australia, including media businesses, publishers, broadcasters and digital platforms. This would create a level playing field that promotes competition in Australian media and advertising markets.

The framework should reflect the evolving media landscape and be underpinned by a sound policy rationale based on the functions or impact of the regulated entities. The framework should include the following matters:

• Underlying principles: clear platform-neutral guiding principles that are applicable across media formats and platforms, and adaptable to new services, platforms and technologies

• Extent of regulation: determination of the appropriate extent of regulation and determining appropriate roles for self-regulation and co-regulation.

• Content rules: a nationally-uniform classification scheme to classify or restrict access to content consistently across different delivery formats.

• Advertising restrictions: a consistent system of advertising restrictions across all delivery platforms, including online and offline channels.

• Enforcement: appropriate monitoring and enforcement mechanisms accompanied by meaningful sanctions.

Given the significance of this reform, the ACCC recommends it be approached in stages to ensure that regulatory disparities of immediate concern are promptly addressed.

Recommendation 9: Stable and adequate funding for the public broadcasters

Stable and adequate funding should be provided to the ABC and SBS in recognition of their role in addressing the risk of under-provision of public interest journalism that generates broad benefits to society.

Recommendation 10: Grants for local journalism

The Regional and Small Publishers Jobs and Innovation Package should be replaced with a targeted grants program that supports the production of original local and regional journalism, including that related to local government and local courts.

The program should be platform-neutral and administered at arm’s length from Government, with eligibility criteria designed by an independent expert committee. Due to its broader scope than the Regional and Small Publishers Jobs and Innovation Package, which provided AU$20 million per year, the program should provide a greater amount of funding – totalling in the order of AU$50 million per year.

The Government should review this program after three years of operation to assess its effectiveness and to determine whether it should be expanded to other areas of public interest journalism at risk of under-provision by the Australian commercial media market.

Recommendation 11: Tax settings to encourage philanthropic support for journalism

Tax settings should be amended to establish new categories of charitable purpose and deductible gift recipient (DGR) status for not-for-profit organisations that create, promote or assist the production of public interest journalism.

To be eligible for ‘registered charity’ and DGR status through these new categories, organisations will need to comply with existing accountability measures overseen by the Australian Charities and Not-for-profits Commission (ACNC). The new charitable purpose and DGR categories should require minimum levels of transparency, impartiality and independence.

For organisations that produce journalism, this should include compliance with existing industry codes such as the Australian Press Council Standards of Practice. In assessing applications for registered charity and DGR status under the new categories, the ACNC and the Australian Tax Office should consider the advice of an independent expert committee.

Recommendation 12: Improving digital media literacy in the community

A Government program be established to fund and certify non-government organisations for the delivery of digital media literacy resources and training based on frameworks currently used by the Online Safety Grants Program and Be Connected program administered by the Office of the eSafety Commissioner. The resources and training should be broadly delivered through community centres, libraries, schools and seniors centres for the benefit of all Australians.

Recommendation 13: Digital media literacy in schools

The Terms of Reference for the review of the Australian Curriculum scheduled for 2020 should include consideration of the approach to digital media literacy education in Australian schools.

Recommendation 14: Monitoring efforts of digital platforms to implement credibility signalling

An independent regulator, such as the ACMA, should be directed to monitor the voluntary initiatives of digital platforms to enable users to identify the reliability, trustworthiness and source of news content featured on their services.

In undertaking this role, the regulator should be empowered to obtain data and information from digital platforms relevant to its inquiries, publicly report on its findings and make recommendations in relation to regulatory action if platforms’ voluntary initiatives are ineffective.

Recommendation 15: Digital Platforms Code to counter disinformation

Digital platforms with more than one million monthly active users in Australia should implement an industry code of conduct to govern the handling of complaints about disinformation (inaccurate information created and spread with the intent to cause harm) in relation to news and journalism, or content presented as news and journalism, on their services. Application of the code should be restricted to complaints about disinformation that meet a ‘serious public detriment’ threshold as defined in the code. The code should also outline actions that constitute suitable responses to complaints, up to and including the take-down of particularly harmful material.

The code should be registered with and enforced by an independent regulator, such as the ACMA, that:

• is given information-gathering powers enabling it to investigate and respond to systemic contraventions of code requirements

• is able to impose sufficiently large sanctions to act as an effective deterrent against code breaches

• provides frequent public reports on the nature, volume and handling of complaints received by digital platforms about disinformation

• reports annually to Government on the efficacy of the code and compliance by digital platforms.

While the code should focus on addressing complaints about disinformation it should also consider appropriate responses to malinformation (information inappropriately spread by bad-faith actors with the intent to cause harm, particularly to democratic processes).

In the event that an acceptable code is not submitted to the regulator within nine months of an announced Government decision on this issue, the regulator should introduce a mandatory industry standard.

The code should be reviewed by the regulator after two years of operation, and the regulator should make recommendations as to whether it should be amended, replaced with an industry standard, or replaced or supplemented with more significant regulation to counter disinformation on digital platforms.

Recommendation 16: Strengthen protections in the Privacy Act

16(a) Update ‘personal information’ definition: Update the definition of ‘personal information’ in the Privacy Act to clarify that it captures technical data such as IP addresses, device identifiers, location data, and any other online identifiers that may be used identify an individual.

16(b) Strengthen notification requirements: Require all collection of personal information to be accompanied by a notice from the APP entity collecting the personal information (whether directly from the consumer or indirectly as a third party), unless the consumer already has this information or there is an overriding legal or public interest reason.

The notice must be concise, transparent, intelligible and easily accessible, written in clear and plain language, provided free of charge, and must clearly set out how the APP entity will collect, use and disclose the consumer’s personal information. Where the personal information of children is collected, the notice should be written at a level that can be readily understood by the minimum age of the permitted digital platform user.

To provide consumers with a readily understood and meaningful overview of an APP entity’s data practices and as a means of reducing their information burden, it may also be appropriate for these requirements to be implemented along with measures such as the use of multi-layered notifications or the use of standardised icons or phrases.

16(c) Strengthen consent requirements and pro-consumer defaults: Require consent to be obtained whenever a consumer’s personal information is collected, used or disclosed by an APP entity, unless the personal information is necessary for the performance of a contract to which the consumer is a party, is required under law, or is otherwise necessary for an overriding public interest reason.

Valid consent should require a clear affirmative act that is freely given, specific, unambiguous and informed (including about the consequences of providing or withholding consent). This means that any settings for data practices relying on consent must be pre-selected to ‘off’ and that different purposes of data collection, use or disclosure must not be bundled. Where the personal information of children is collected, consents to collect the personal information of children must be obtained from the child’s guardian. It may also be appropriate for the consent requirements to be implemented along with measures to minimise consent fatigue, such as not requiring consent when personal information is processed in accordance with a contract to which the consumer is a party, or using standardised icons or phrases to refer to certain categories of consents to facilitate consumers’ comprehension and decision-making.

16(d) Enable the erasure of personal information: Require APP entities to erase the personal information of a consumer without undue delay on receiving a request for erasure from the consumer, unless the retention of information is necessary for the performance of a contract to which the consumer is a party, is required under law, or is otherwise necessary for an overriding public interest reason.

16(e) Introduce direct rights of action for individuals: Give individuals a direct right to bring actions and class actions against APP entities in court to seek compensation for an interference with their privacy under the Privacy Act.

16(f) Higher penalties for breach of the Privacy Act: Increase the penalties for an interference with privacy under the Privacy Act to mirror the increased penalties for breaches of the Australian Consumer Law.

Recommendation 17: Broader reform of Australian privacy law

Broader reform of Australian privacy regime to ensure it continues to effectively protect consumers’ personal information in light of the increasing volume and scope of data collection in the
digital economy.

This reform should have regard to the following issues:

1. Objectives: whether the objectives of the Privacy Act should place greater emphasis on privacy protections for consumers including protection against misuse of data and empowering consumers to make informed choices.

2. Scope: whether the Privacy Act should apply to some of the entities which are currently exempt (for example small businesses, employers, registered political parties, etc.).

3. Higher standard of protections: whether the Privacy Act should set a higher standard of privacy protection, such as by requiring all use and disclosure of personal information to be by fair and lawful means.

4. Inferred information: whether the Privacy Act should offer protections for inferred information, particularly where inferred information includes sensitive information about an individual’s health, religious beliefs, political affiliations.

5. De-identified information: whether there should be protections or standards for de-identification, anonymisation and pseudonymisation of personal information to address the growing risks of re-identification as datasets are combined and data analytics technologies become more advanced.

6. Overseas data flows: whether the Privacy Act should be revised such that it could be considered by the European Commission to offer ‘an adequate level of data protection’ to facilitate the flow of information to and from overseas jurisdictions such as the EU.

7. Third-party certification: whether an independent certification scheme should be introduced.

Recommendation 18: OAIC privacy code for digital platforms

An enforceable code of practice developed by the OAIC, in consultation with industry stakeholders, to enable proactive and targeted regulation of digital platforms’ data practices (DP Privacy Code). The code should apply to all digital platforms supplying online search, social media, and content aggregation services to Australian consumers and which meet an objective threshold regarding the collection of Australian consumers’ personal information.

The DP Privacy Code should be enforced by the OAIC and accompanied by the same penalties as are applicable to an interference with privacy under the Privacy Act. The ACCC should also be involved in developing the DP Privacy Code in its role as the competition and consumer regulator.

The DP Privacy Code should contain provisions targeting particular issues arising from data practices of digital platforms, such as:

1. Information requirements: requirements to provide and maintain multi-layered notices regarding key areas of concern and interest for consumers. The first layer of this notice should contain a concise overview followed by more detailed information in subsequent layers. The final layer of the notice should contain all relevant information that details how a consumer’s data may be collected, used, disclosed and shared by the digital platform, as well as the name and contact details for each third party to whom personal information may be disclosed.

2. Consent requirements: requirements to provide consumers with specific, opt-in controls for any data collection that is for a purpose other than the purpose of supplying the core consumer-facing service and, where consents relate to the collection of children’s personal information, additional requirements to verify that consent is given or authorised by the child’s guardian.

3. Opt-out controls: requirements to give consumers the ability to select global opt-outs or opt- ins, such as collecting personal information for online profiling purposes or sharing of personal information with third parties for targeted advertising purposes.

4. Children’s data: additional restrictions on the collection, use or disclosure of children’s personal information for targeted advertising or online profiling purposes and requirements to minimise the collection, use and disclosure of children’s personal information.

5. Information security: requirements to maintain adequate information security management systems in accordance with accepted international standards.

6. Retention period: requirements to establish a time period for the retention of any personal information collected or obtained that is not required for providing the core consumer-facing service.

7. Complaints-handling: requirements to establish effective and timely mechanisms to address consumer complaints.

The ACCC considers that this recommendation could align with the Government’s March 2019 announcement to create a legislated code applying to social media and online platforms which trade in personal information.

Recommendation 19: Statutory tort for serious invasions of privacy

Introduce a statutory cause of action for serious invasions of privacy, as recommended by the Australian Law Reform Commission (ALRC). This cause of action provides protection for individuals against serious invasions of privacy that may not be captured within the scope of the Privacy Act. The cause of action should require privacy to be balanced against other public interests, such as freedom of expression and freedom of the media. This statutory cause of action will increase the accountability of businesses for their data practices and give consumers greater control over their personal information.

Recommendation 20: Prohibition against unfair contract terms

Amend the Competition and Consumer Act 2010 so that unfair contract terms are prohibited (not just voidable). This would mean that civil pecuniary penalties apply to the use of unfair contract terms in any standard form consumer or small business contract.

Recommendation 21: Prohibition on certain unfair trading practices

Amend the Competition and Consumer Act 2010 to include a prohibition on certain unfair trading practices. The scope of such a prohibition should be carefully developed such that it is sufficiently defined and targeted, with appropriate legal safeguards and guidance.

The ACCC notes the current work on this issue being undertaken as part of the Consumer Affairs Australia and New Zealand (CAANZ) process, and will progress its support for the recommendation through that forum.