The recently released ACCC report into Digital Platforms strongly suggests a view within the regulator that marketplace rules have not kept pace with the impact of rapidly evolving technology online, according to legal experts who have studied the findings.
More importantly for Australian businesses which have invested heavily in their data and analytics capabilities to improve customer experiences, some commentators argue the language in the report presages an extended period of re-regulation and enforcement.
While the Inquiry — which began in December 2017 at the direction of the then-Treasurer and now Prime Minister Scott Morrison — sought to examine the impact of digital platforms such as search engines and social media on the competitive media landscape, there are few indications in the final report of any direct regulatory action on that front.
Instead, there is a renewed focus on the use of data and the implications for consumer privacy. And it seems likely that this will be where the report potentially has its most lasting impact, according to some industry experts, despite the fact that the privacy issue was tackled extensively as recently as 2014.
Of course in the five years since then, Europe has introduced its General Data Protection Regulation (GDPR), California has introduced its own privacy legislation called the California Consumer Privacy Act (CCPA) which takes effect next year, and Australia most recently passed the Consumer Data Right (CDR) — the first step on the path to Open Banking.
The thread running through all of these laws is an intention by regulators to shift power — and to some extent control of data — back into the hands of consumers.
All this regulatory change reinforces ADMA’s view, described in its submission to the preliminary Data Platforms Inquiry, published in December 2018: “Any inquiry into the state of competition in the marketing and advertising services market must, as a matter of necessity, take account of the rapid speed of technological improvements and innovations that make the continued disruption and transformation of the market and economy inevitable.”
The more things change, the faster they change
Marketers like to say that change has never been as fast as it is today, and that it will likely never be this slow again.
The views of legal practitioners who have offered early commentary on the final ACCC Digital Platform Inquiry (DPI) report suggest more change and more acceleration in the years ahead.
According to legal firm Corrs, for instance, “Some of the most significant aspects of the final report are arguably the ACCC’s recommendations in relation to data privacy, consent requirements and communications with consumers about how data is handled.”
That suggests organisations will need to divert additional resources to compliance. But beyond compliance and the costs that come with it, new privacy rules will also require changes in work practices and in the technology that underpins them.
Corrs also warns of an increase in class actions and other private litigation which they say is also likely “… if reforms such as the recommended introduction of a statutory tort for serious invasions of privacy are implemented.”
Additional legal commentary, this time from Gaden’s, flags ACCC support for the introduction of much tougher penalties for privacy law breaches. It suggests that “A direct right of action (and class action) could be introduced for breach of the Privacy Act 1988 (Cth).”
Furthermore, the definition of consent may change, says Gadens, with more explicit “opt-in” provisions along with the introduction of a GDPR-style right to be forgotten.
All of these changes will have a potentially significant impact on the way companies communicate and interact with their customers and consumers. It may also have a cost impact at an infrastructure level, as systems need to be adjusted to reflect new privacy rules.
According to Gadens, “The ACCC is advocating changes to laws to give consumers greater control over their personal information, to increase the accountability of businesses for data practices and to address the need for privacy laws in Australia to have a meaningful deterrence effect.”
AMDA is preparing a submission to the government on the final DPI report. In it, ADMA presents new evidence that calls into question the ACCC’s conclusion that Australia’s current privacy regime is deficient, and that new privacy laws are required. By benchmarking Australian consumers against those of nine other developed economies, the research finds that consumers here are much more aware of their privacy rights than the DPI gives them credit for, and much more willing to engage in a value exchange with brands and organisations they trust.
While ADMA accepts the ACCC’s conclusion that improvements are needed in data privacy practice in some areas, we disagree with the suggestion that these challenges can only be met by further changes to privacy and consumer protection laws.
ADMA contends that Australia’s existing principles-based privacy laws — deliberately constructed to be media neutral — remain well suited to meet current and future technology-driven changes to marketing and advertising communications. Varying the Australian Privacy Principles (APPs) to address perceived issues with digital media would be a significant breach of that core principle of media neutrality, and would invite further tinkering each time a new technological challenge comes our way.
The ACCC has not made the case for amending the APPs, which have only been in place since 2012 and are built upon the previous National Privacy Principles framework. Australian businesses and consumers have more than 20 years’ experience operating within a principles-based legal framework and both businesses and consumers have learned and adapted their behaviour along the way. This process of learning and adapting continues today and will undoubtedly do so on into the future.
When consumer privacy expectations fall out of alignment with business practice, the law and market forces have combined to bring them back into equilibrium. This is why organisational privacy policies and practices are constantly under review and amendment: to respond to changing technology and customer expectations. This is why new privacy-enhancing technologies are constantly emerging.
The ACCC, in the course of its Digital Platforms Inquiry, has taken a snapshot of the data-driven marketplace in 2019 and found it wanting. But the marketplace is both dynamic and agile; regulators and policy makers should not dismiss or ignore its ability to self-correct in response to the demands of society.
Moreover, consumers are nowhere near as vulnerable, naïve and victimised by big business as they are portrayed in the DPI report. This fact is borne out by recent research that benchmarks Australian consumers against other developed countries.
As a member of the Global Alliance of Data-Driven Marketing Associations, ADMA participated in a global research effort in 2018 to better understand consumer privacy expectations. The work maps Australian consumer attitudes to privacy against those of nine other countries around the world in which data-driven marketing channels are well developed.
The findings of this research represent an interesting counterpoint to surveys done periodically by the Australian Privacy Commissioner on Australian consumer attitudes to privacy. In particular, it reveals a more nuanced view of ‘consent’ and the value exchange between consumers and brands.
The research found that about half (51%) of consumers across ten global markets are what it dubs 'Data Pragmatists' - people who are happy to exchange data with businesses as long as there is a clear benefit for doing so. Just over a quarter (26%) of global consumers are 'Data Unconcerned' - people who show little or no concern about the use or collection of their personal data. another one in four (23%) fall into the 'Data Fundamentalist' category - people who are unwilling to share personal information under any circumstances. Among this latter group, older Australians stand out as being relatively more cautious than their counterparts in other countries. By contrast, younger Australians tend to be more willing than average to enter into a value exchange involving their personal information.
Importantly, the vast majority of global consumers (77%), including Australians, show no fundamental objection to engaging in the data economy. Global privacy concerns are high, but there is general satisfaction with the amount of data shared.
Similar to the findings of the Australian Privacy Commissioner, a majority of global consumers indicate a relatively high level of concern with the issue of online privacy, with an average of 74 per cent across the ten markets stating a degree of concern. Despite this, the majority of consumers surveyed across all markets claim they are happy with the amount of personal information they currently exchange (for Australia, this figure is 53%).
Linkages between age and privacy concerns
Across global markets, there is a clear trend in terms of the consumer groups that are most likely to fall within the three segments above. For example, younger consumers globally are far more aligned to the Unconcerned mindset compared to older age groups. At the same time, older consumers are much more likely to be Data Fundamentalists. In Australia, 38 per cent of consumers surveyed aged 65+ are Data Fundamentalists compared to just 15 per cent of consumers aged 18–24.
These findings suggest that younger, more tech-savvy consumers have emerged — through their exposure to the education system and a greater openness to exploring new technologies — more sophisticated in their interactions with the data economy. They are aware of their privacy rights and they are taking control of their digital footprint. As this group becomes the dominant cohort of consumers, the power balance between digital platforms and their users will become less of an issue for policy makers. The current impulse to erect new regulatory ramparts behind which to herd and safeguard consumers will diminish.
We would like to hear your views. You can email us at firstname.lastname@example.org