In brief 7 min read
In a trail-blazing and world-leading move, the ACCC has commenced proceedings against Google, alleging it engaged in misleading conduct and made false or misleading representations to consumers about how and when it collects, keeps and uses their personal information in relation to location data. It is the first case brought globally to probe Google's approach to location data collection, and is likely to increase the focus on consumer awareness of data use in digital markets.
Whatever the outcome of the case, the Google proceedings are a reminder to all companies of the need to communicate clearly with consumers, and to address any potential or actual risks of inadequate disclosure.
Key takeaways
- The crux of the ACCC's case is that Google deprived users of making an informed choice about Google's collection and use of their personal location data through misleading conduct and representations.
- It is the first case worldwide to challenge this aspect of Google's practices and shows that the ACCC is willing to break new ground in enforcing the growing intersection between consumer and privacy law.
- These proceedings are another reminder of the need for companies to communicate clearly with consumers about use of their data. Companies should check that definitive representations made to consumers match the functionality of products or services made available to them and properly reflect the way they use and disclose personal information.
The ACCC's case: location, location, location
In the concise statement lodged with the Federal Court of Australia on 29 October 2019, the ACCC outlines its case against Google LLC and Google Australia, under the Competition and Consumer Act 2010 (Cth). The ACCC alleges that, from at least January 2017, Google's conduct and representations regarding consumers' location data made on Android mobile phones and tablets misled consumers in violation of the Australian Consumer Law (ACL).
The ACCC has, in an unusual and interesting step, provided its own definition of personal data. The ACCC defines this as being data that is 'identifiable as being associated with the holder of a particular Google Account', rather than using the well-established term 'personal information'.
At the centre of the case are two Google Account settings: 'Location History' and 'Web & App Activity'. These settings enable users to control whether Google obtains, keeps and uses personal data relating to their location when using Google services. To stop Google collecting and retaining location data, both settings had to be switched off by users. However, the ACCC alleges that from January 2017 until late 2018, Google misled consumers by not properly disclosing this fact to its users.
The ACCC maintains [Google's] conduct deprived consumers of the ability to make an informed choice about the collection and use of their personal data relating to location, and that if they had had such a choice, they may have chosen to stop Google doing so.
The ACCC claims that, during this period, when users set up a Google Account on their Android device or later wished to turn off Google's location data collection, they would have been led to incorrectly believe that 'Location History' was the only setting that controlled whether Google obtained, kept and used their location data. The ACCC's claim says there was nothing to alert the user to the fact that even if 'Location History' was switched off, Google could continue to collect data on location through the 'Web & App Activity' setting. Similarly, the ACCC alleges the 'Web & App Activity' setting did not make any reference to location data, and did not notify or alert the user that if this setting was 'on', Google may continue to obtain, retain and use personal data about their location. In addition, the ACCC claims that, during 2018, Google incorrectly represented to users that the only way they could prevent it from collecting, keeping and using their location data was to stop using certain Google services, including Google Search and Google Maps, when in fact this could be achieved by switching off both ‘Location History’ and ‘Web & App Activity’.
In relation to Google's representations regarding its use of location data, the ACCC claims that during certain timeframes, when a user accessed either of the relevant settings, Google notified them via on-screen messages that location data would only be collected and used by it for that person's use of Google services. In these circumstances, it is alleged Google failed to disclose it may use the data for its own purposes, unrelated to the user's use of Google services, including:
- to personalise advertisements for other users;
- to infer demographic information;
- to measure the performance of advertisements;
- to promote, offer to supply or supply advertising services to third parties; or
- to produce anonymised, aggregated statistics and share those statistics with advertisers.
It is the ACCC's case that, as a consequence of this conduct and the representations, Google led consumers to understand that personal data about their location was not being collected, retained or used by Google when this was, in fact, occurring. The ACCC maintains this conduct deprived consumers of the ability to make an informed choice about the collection and use of their personal data relating to location, and that if they had had such a choice, they may have chosen to stop Google doing so. Moreover, it is claimed that the location data of many users during the relevant timeframe was obtained, retained and used by Google (including for its own purposes) without the users' knowledge.
Relief sought by the ACCC
The ACCC is seeking penalties, declarations and orders requiring the publication of corrective notices and the establishment of a compliance program. The alleged infringements span two different penalty regimes, with contraventions from September 2018 attracting the new increased maximum penalty level of three times the value received from an offence, or up to 10% of annual turnover (increased from $1.1 million for each contravention).
Google has expressed its intention to defend the ACCC's claim.
Regulatory action
While there have been multiple investigations around the world into some of Google's business practices, this is the first action to focus on Google's collection, retention and use of consumers' location data, from the perspective of the adequacy of disclosures made to consumers.
The narrow scope of the proceedings, focusing only on Google's Android devices, has likely been a deliberate move by the ACCC to more easily satisfy the evidential burden required to bring an initial case to court.
...this is the first action to focus on Google's collection, retention and use of consumers' location data, from the perspective of the adequacy of disclosures made to consumers.
It is interesting to contrast the ACCC's enforcement approach in this case with the action taken by Germany's Bundeskartellamt against Facebook for its practice of making the use of its social network by private users conditional on the collection of personal and device-related data from Facebook-owned services, as well as third party websites and apps. The German regulator framed its case as an abuse of dominance infringement under its competition law regime - a strategy that is now being questioned by the Regional Court of Düsseldorf, which is reviewing the legality of the February 2019 decision, challenging whether there is sufficient connection between the alleged abuse and Facebook's dominance, and whether a breach of data protection rules amounts to an abuse under competition laws. As both the competition and consumer regulator, the ACCC has chosen to use its consumer protection powers to focus on the misleading nature of Google's practices, rather than pursue a novel misuse of market power argument.
The ACCC Chair, Rod Sims, recently stated that 'transparency and inadequate disclosure issues involving digital platforms and consumer data were a major focus of our Digital Platforms Inquiry, and remain one of the ACCC's top priorities'.
The Digital Platforms Inquiry final report indicates the ACCC is also investigating:
- whether representations by Google about its privacy policy, and the level of disclosure about subsequent privacy policy changes that enabled Google to combine or match different sets of user data, raise issues under the ACL;
- whether representations made by Facebook (and/or its related entities) in relation to the nature of its services and the scope of its terms and conditions, including terms and conditions that allowed user data to be shared with third parties, raise issues under the ACL; and
- whether terms of use and privacy policies used by Facebook (and/or its related entities) contain unfair contract terms.
The intersection of privacy legislation and the adequacy of disclosure
The ability of consumers to make informed choices about the use of their personal information is currently a key concern of the ACCC, and this case brought by the ACCC illustrates the increasing intersection between consumer and privacy law. The ACCC's Digital Platforms Inquiry final report recommended privacy legislation be strengthened by revising the definition of 'personal information' to incorporate various online identifiers (including location data), and by strengthening notification and consent requirements so consumers are able to make more 'informed decisions about the personal data they allow digital platforms to collect'.
the Google proceedings show a willingness of the ACCC to be actively involved in regulating the use of personal information in a consumer context.
Some of those recommendations have come under scrutiny from privacy experts, and submissions have been made to the Commonwealth Government proposing that material changes to existing privacy law should only follow completion of a detailed Australian Law Reform Commission review.
Nonetheless, the Google proceedings show a willingness of the ACCC to be actively involved in regulating the use of personal information in a consumer context. The case follows the ACCC instituting proceedings against HealthEngine for allegedly manipulating reviews and misusing patient data by selling it to insurance brokers without disclosing this to patients. This latest move also highlights a relative disparity between the willingness of the ACCC to break new ground on the one hand, compared to the Office of the Australian Information Commissioner's relatively infrequent use of its privacy regulatory powers on the other.
Whatever the outcome of the case, the Google proceedings are a reminder to all companies of the need to communicate clearly with consumers, and to address any potential or actual risks of inadequate disclosure by ensuring definitive representations made to consumers match the functionality of products or services made available to them, and also properly reflect the way they use and disclose personal information.