The ACCC's recommendations in its
Digital Platforms report, released today, are
R 1: Changes to merger law
Section 50(3) of the Competition and Consumer Act 2010 (CCA) be amended to incorporate the following additional merger factors:
(j) the likelihood that the acquisition would result in the removal from the market of a potential competitor;
(k) the nature and significance of assets, including data and technology, being acquired directly or through the body corporate.
R 2: Advance notice of acquisitions
Large digital platforms to agree to a notification protocol, to provide advance notice to the ACCC of any proposed acquisitions potentially impacting competition in Australia. The details of the notification protocol will be agreed between the ACCC and each large digital platform, and would specify:
ƒ the types of acquisitions requiring notification (including any applicable minimum transaction value), and
ƒ the minimum advance notification period prior to completion of the proposed transaction to enable the ACCC to assess the proposed acquisition.
If such a commitment were not forthcoming from the large digital platforms, the ACCC will make further recommendations to the Government that address this issue.
R3: Changes to search engine and internet browser defaults
Google should provide Australian users of Android devices with the same options being rolled out to existing Android users in Europe; that is, the ability to choose their default search engine and default internet browser from a number of options.
If Google does not introduce similar options for Australian Android users by six months from the date of the Report, the ACCC will submit to the Government that it should consider compelling Google to offer this choice.
Direction for future ACCC work: Data portability
The ACCC will revisit the applicability of the Consumer Data Right to digital platforms in the future. The ACCC considers that data portability is unlikely to have a significant effect on barriers to entry and expansion in certain digital platform markets in the short term. If data portability or interoperability were identified to be beneficial in addressing the issues of market power and competitive entry or switching, the ACCC could recommend this to government, as part of the role envisaged under Recommendation 4.
However, the ACCC recognises that aside from addressing issues of market power, portability of data held by digital platforms may deliver significant benefits to current and potential future markets including through innovation and the development of new services. The ACCC will consider the benefits associated with digital platform data portability in the ordinary course as it considers sectors to which the Consumer Data Right regime may apply in the future.
R4: Proactive investigation, monitoring and enforcement of issues in markets in which digital platforms operate
A specialist digital platforms branch be established within the ACCC to build on and develop expertise in digital markets and the use of algorithms, with the purpose of:
ƒƒproactively monitoring and investigating instances of potentially anti-competitive conduct and conduct causing consumer harm by digital platforms, which impact consumers, advertisers or other business users (including news media businesses)
ƒƒtaking action to enforce competition and consumer laws relating to the conduct of digital platforms
ƒƒconducting inquiries and making recommendations to Government to address consumer harm and impediments to the efficient and effective operation of the markets in which digital platforms operate, caused by market failure.
This branch should be empowered by Ministerial direction to hold an extended public inquiry covering a period of at least five years and have the ability to compel relevant information.
R 5: Inquiry into ad tech services and advertising agencies
The specialist digital platforms branch (as proposed by Recommendation 4) be directed to hold an inquiry into competition for the supply of ad tech services and the supply of online advertising services by advertising and media agencies. Matters to be taken into account should include:
ƒƒwhether a lack of transparency is impacting the efficient operation of these markets
ƒƒthe prices charged by suppliers of these services and the share of advertising expenditure they retain
(including whether any potential excessive margins are obtained)
ƒƒhow these services are purchased and sold, including any auction and bidding processes
ƒƒthe relationship between suppliers and customers of these services, including the extent to which company structures or contractual arrangements limit effective competition
ƒƒthe impact of consolidation of services on competition.
This inquiry should be empowered by Ministerial direction, have the ability to compel relevant
information, and be completed over a period of 18 months.
R 6: Process to implement harmonised media regulatory framework
A new platform-neutral regulatory framework be developed and implemented to ensure effective and consistent regulatory oversight of all entities involved in content production or delivery in Australia, including media businesses, publishers, broadcasters and digital platforms. This would create a level playing field that promotes competition in Australian media and advertising markets.
The framework should reflect the evolving media landscape and be underpinned by a sound policy rationale based on the functions or impact of the regulated entities. The framework should include the following matters:
ƒƒ
Underlying principles: clear platform-neutral guiding principles that are applicable across media formats and platforms, and adaptable to new services, platforms and technologies
ƒƒ
Extent of regulation: determination of the appropriate extent of regulation and determining appropriate roles for self-regulation and co-regulation.
ƒƒ
Content rules: a nationally-uniform classification scheme to classify or restrict access to content consistently across different delivery formats.
ƒƒAdvertising restrictions: a consistent system of advertising restrictions across all delivery platforms, including online and offline channels.
Enforcement: appropriate monitoring and enforcement mechanisms accompanied by meaningful sanctions.
Given the significance of this reform, the ACCC recommends it be approached in stages to ensure that regulatory disparities of immediate concern are promptly addressed.
R 7: Designated digital platforms to provide codes of conduct governing relationships between digital platforms and media businesses to the ACMA
Designated digital platforms to each implement a code of conduct to govern their relationships with news media businesses. Each platform’s code of conduct should ensure that they treat news media businesses fairly, reasonably and transparently in their dealings with them, and contain at least the following commitments:
ƒƒthe sharing of data with news media businesses
ƒƒthe early notification of changes to the ranking or display of news content
ƒƒthat the digital platform’s actions will not impede news media businesses’ opportunities to monetise their content appropriately on the digital platform’s sites or apps, or on the media businesses’ own sites or apps
ƒƒwhere the digital platform obtains value, directly or indirectly, from content produced by news media businesses, that the digital platform will fairly negotiate with news media businesses as to how that revenue should be shared, or how the news media businesses should be compensated.
The ACMA will publish guidelines regarding how the code should be developed and what should be included in the code. I
n performing its role under this recommendation, the ACMA shall closely consult with the ACCC.
The ACMA will also designate the digital platforms that will be required to implement a code; review and approve the content of the codes (after consulting news media businesses). The ACMA will enforce the codes and have appropriate investigative and information gathering powers and the capacity to impose sufficiently large sanctions for breaches to act as an effective deterrent. The ACMA will also have the ability to require digital platforms to amend their codes in specific ways, if it considers that the objectives of the code are not being achieved.
Digital platforms will have nine months to develop a code, and will be required to demonstrate that they have consulted fully with news media businesses in drafting their code, and carefully assessed the issues raised by them. The duration of the code will be proposed by the digital platform and subject to approval by the ACMA.
If a digital platform is unable to submit an acceptable code to the ACMA within nine months of designation, the ACMA should create a mandatory standard to apply to the designated digital platform.
R 8: Mandatory ACMA take-down code to assist copyright enforcement on digital platforms
A mandatory industry code be implemented to govern the take-down processes of digital platforms operating in Australia. The code will enable rights holders to ensure the effective and timely removal of copyright-protected content from digital platforms.
The mandatory code should be enforced by the ACMA and have appropriate sanctions and penalty provisions. The content of the code should be developed by the ACMA in consultation with industry including rights holders and digital platforms, and include a framework for cooperation between rights holders and digital platforms which provides guidance regarding key issues of concern for stakeholders including:
ƒƒ
Cooperation framework: a framework for cooperation between rightsholders and digital platforms to proactively identify and prevent the distribution of copyright-infringing content online, including an appropriate division of the responsibility for monitoring online content for copyright-infringement.
ƒƒ
Communication: measures to improve the ease of communications between rightsholders and digital platforms, including requirements for designated agents of digital platforms to be available during Australian business hours as well as appropriate periods where key Australian live events are broadcasted.
ƒƒ
Timeframes: reasonable timeframes for the removal of infringing content and processes targeted at the timely removal of particularly time-sensitive content such as live commercial broadcasts.
ƒƒ
Bulk notifications: mechanisms for rightsholders to make bulk notifications to address repeated infringements of the same content and to sanction users who commit multiple or regular infringements.
ƒƒ
Proof of copyright: measures to streamline the process by which rightsholders may prove copyright ownership, particularly in cases where there is joint-authorship.
R 9: Stable and adequate funding for the public broadcasters
Stable and adequate funding should be provided to the ABC and SBS in recognition of their role in addressing the risk of under-provision of public interest journalism that generates broad benefits to society.
R 10: Grants for local journalism
The Regional and Small Publishers Jobs and Innovation Package should be replaced with a targeted grants program that supports the production of original local and regional journalism, including that related to local government and local courts.
The program should be platform-neutral and administered at arm’s length from Government, with eligibility criteria designed by an independent expert committee. Due to its broader scope than the Regional and Small Publishers Jobs and Innovation Package, which provided AU$20 million per year, the program should provide a greater amount of funding – totalling in the order of AU$50 million per year.
The Government should review this program after three years of operation to assess its effectiveness and to determine whether it should be expanded to other areas of public interest journalism at risk of under-provision by the Australian commercial media market.
R 11: Tax settings to encourage philanthropic support for journalism
Tax settings should be amended to establish new categories of charitable purpose and deductible gift recipient (DGR) status for not-for-profit organisations that create, promote or assist the production of public interest journalism.
To be eligible for ‘registered charity’ and DGR status through these new categories, organisations will need to comply with existing accountability measures overseen by the Australian Charities and Not-for-profits Commission (ACNC). The new charitable purpose and DGR categories should require minimum levels of transparency, impartiality and independence.
For organisations that produce journalism, this should include compliance with existing industry codes such as the Australian Press Council Standards of Practice. In assessing applications for registered charity and DGR status under the new categories, the ACNC and the Australian Tax Office should consider the advice of an independent expert committee.
R 12: Improving digital media literacy in the community
A Government program be established to fund and certify non-government organisations for the delivery of digital media literacy resources and training based on frameworks currently used by the Online Safety Grants Program and Be Connected program administered by the Office of the eSafety Commissioner. The resources and training should be broadly delivered through community centres, libraries, schools and seniors centres for the benefit of all Australians.
R 13: Digital media literacy in schools
The Terms of Reference for the review of the Australian Curriculum scheduled for 2020 should include consideration of the approach to digital media literacy education in Australian schools.
R 14: Monitoring efforts of digital platforms to implement credibility signalling
An independent regulator, such as the ACMA, should be directed to monitor the voluntary initiatives of digital platforms to enable users to identify the reliability, trustworthiness and source of news content featured on their services.
In undertaking this role, the regulator should be empowered to obtain data and information from digital platforms relevant to its inquiries, publicly report on its findings and make recommendations in relation to regulatory action if platforms’ voluntary initiatives are ineffective.
R 15: Digital Platforms Code to counter disinformation
Digital platforms with more than one million monthly active users in Australia should implement an industry code of conduct to govern the handling of complaints about disinformation (inaccurate information created and spread with the intent to cause harm) in relation to news and journalism, or content presented as news and journalism, on their services. Application of the code should
be restricted to complaints about disinformation that meet a ‘serious public detriment’ threshold as defined in the code. The code should also outline actions that constitute suitable responses to complaints, up to and including the take-down of particularly harmful material.
The code should be registered with and enforced by an independent regulator, such as the ACMA, that:
ƒƒis given information-gathering powers enabling it to investigate and respond to systemic contraventions of code requirements
ƒƒis able to impose sufficiently large sanctions to act as an effective deterrent against code breaches ƒƒprovides frequent public reports on the nature, volume and handling of complaints received by
digital platforms about disinformation
ƒƒreports annually to Government on the efficacy of the code and compliance by digital platforms.
While the code should focus on addressing complaints about disinformation it should also consider appropriate responses to malinformation (information inappropriately spread by bad-faith actors with the intent to cause harm, particularly to democratic processes).
In the event that an acceptable code is not submitted to the regulator within nine months of an announced Government decision on this issue, the regulator should introduce a mandatory industry standard.
The code should be reviewed by the regulator after two years of operation, and the regulator
should make recommendations as to whether it should be amended, replaced with an industry standard, or replaced or supplemented with more significant regulation to counter disinformation on digital platforms.
R 16: Strengthen protections in the Privacy Act
16(a) Update ‘personal information’ definition:
Update the definition of ‘personal information’ in the Privacy Act to clarify that it captures technical data such as IP addresses, device identifiers, location data, and any other online identifiers that may be used identify an individual.
16(b) Strengthen notification requirements:
Require all collection of personal information to be accompanied by a notice from the APP entity collecting the personal information (whether directly from the consumer or indirectly as a third party), unless the consumer already has this information or there is an overriding legal or public interest reason.
The notice must be concise, transparent, intelligible and easily accessible, written in clear and plain language, provided free of charge, and must clearly set out how the APP entity will collect, use and disclose the consumer’s personal information. Where the personal information of children is collected, the notice should be written at a level that can be readily understood by the minimum age of the permitted digital platform user.
To provide consumers with a readily understood and meaningful overview of an APP entity’s data practices and as a means of reducing their information burden, it may also be appropriate for these requirements to be implemented along with measures such as the use of multi-layered notifications or the use of standardised icons or phrases.
16(c) Strengthen consent requirements and pro-consumer defaults:
Require consent to be obtained whenever a consumer’s personal information is collected, used or disclosed by an APP entity, unless the personal information is necessary for the performance of a contract to which the consumer is a party, is required under law, or is otherwise necessary for an overriding public interest reason.
Valid consent should require a clear affirmative act that is freely given, specific, unambiguous and informed (including about the consequences of providing or withholding consent). This means that any settings for data practices relying on consent must be pre-selected to ‘off’ and that different purposes of data collection, use or disclosure must not be bundled. Where the personal information of children is collected, consents to collect the personal information of children must be obtained from the child’s guardian.
It may also be appropriate for the consent requirements to be implemented along with measures to minimise consent fatigue, such as not requiring consent when personal information is processed in accordance with a contract to which the consumer is a party, or using standardised icons or phrases to refer to certain categories of consents to facilitate consumers’ comprehension and decision-making.
16(d) Enable the erasure of personal information:
Require APP entities to erase the personal information of a consumer without undue delay on receiving a request for erasure from the consumer, unless the retention of information is necessary for the performance of a contract to which the consumer is a party, is required under law, or is otherwise necessary for an overriding public interest reason.
16(e) Introduce direct rights of action for individuals:
Give individuals a direct right to bring actions and class actions against APP entities in court to seek compensation for an interference with their privacy under the Privacy Act.
16(f) Higher penalties for breach of the Privacy Act:
Increase the penalties for an interference with privacy under the Privacy Act to mirror the increased penalties for breaches of the Australian Consumer Law.
R 17: Broader reform of Australian privacy law
Broader reform of Australian privacy regime to ensure it continues to effectively protect consumers’ personal information in light of the increasing volume and scope of data collection in the
digital economy.
This reform should have regard to the following issues:
1. Objectives: whether the objectives of the Privacy Act should place greater emphasis on privacy protections for consumers including protection against misuse of data and empowering consumers to make informed choices.
2. Scope: whether the Privacy Act should apply to some of the entities which are currently exempt (for example small businesses, employers, registered political parties, etc.).
3. Higher standard of protections:whether the PrivacyAct should set a higher standard of privacy protection, such as by requiring all use and disclosure of personal information to be by fair and lawful means.
4. Inferred information: whether the Privacy Act should offer protections for inferred information, particularly where inferred information includes sensitive information about an individual’s health, religious beliefs, political affiliations.
5. De-identified information: whether there should be protections or standards for de-identification, anonymisation and pseudonymisation of personal information to address the growing risks of re-identification as datasets are combined and data analytics technologies become more advanced.
6. Overseas dataflows: whether the Privacy Act should be revised such that it could be considered by the European Commission to offer ‘an adequate level of data protection’ to facilitate the flow of information to and from overseas jurisdictions such as the EU.
7. Third-party certification: whether an independent certification scheme should be introduced.
R 18: OAIC privacy code for digital platforms
An enforceable code of practice developed by the OAIC, in consultation with industry stakeholders, to enable proactive and targeted regulation of digital platforms’ data practices (DP Privacy Code). The code should apply to all digital platforms supplying online search, social media, and content aggregation services to Australian consumers and which meet an objective threshold regarding the collection of Australian consumers’ personal information.
The DP Privacy Code should be enforced by the OAIC and accompanied by the same penalties as are applicable to an interference with privacy under the Privacy Act. The ACCC should also be involved in developing the DP Privacy Code in its role as the competition and consumer regulator.
The DP Privacy Code should contain provisions targeting particular issues arising from data practices of digital platforms, such as:
1. Information requirements: requirements to provide and maintain multi-layered notices regarding key areas of concern and interest for consumers. The first layer of this notice should contain a concise overview followed by more detailed information in subsequent layers. The final layer of the notice should contain all relevant information that details how a consumer’s data may be collected, used, disclosed and shared by the digital platform, as well as the name and contact details for each third party to whom personal information may be disclosed.
2. Consent requirements:requirements to provide consumers with specific,opt-in controls for any data collection that is for a purpose other than the purpose of supplying the core consumer-facing service and, where consents relate to the collection of children’s personal information, additional requirements to verify that consent is given or authorised by the child’s guardian.
3. Opt-out controls: requirements to give consumers the ability to select global opt-outs or opt-ins, such as collecting personal information for online profiling purposes or sharing of personal information with third parties for targeted advertising purposes.
4. Children’s data: additional restrictions on the collection, use or disclosure of children’s personal information for targeted advertising or online profiling purposes and requirements to minimise the collection, use and disclosure of children’s personal information.
5. Information security: requirements to maintain adequate information security management systems in accordance with accepted international standards.
6. Retention period: requirements to establish a time period for the retention of any personal information collected or obtained that is not required for providing the core consumer-facing service.
7. Complaints-handling: requirements to establish effective and timely mechanisms to address consumer complaints.
The ACCC considers that this recommendation could align with the Government’s March 2019 announcement to create a legislated code applying to social media and online platforms which trade in personal information.
R 19: Statutory tort for serious invasions of privacy
Introduce a statutory cause of action for serious invasions of privacy, as recommended by the Australian Law Reform Commission (ALRC). This cause of action provides protection for individuals against serious invasions of privacy that may not be captured within the scope of the Privacy Act. The cause of action should require privacy to be balanced against other public interests, such as freedom of expression and freedom of the media. This statutory cause of action will increase the accountability of businesses for their data practices and give consumers greater control over their personal information.
R 20: Prohibition against unfair contract terms
Amend the Competition and Consumer Act 2010 so that unfair contract terms are prohibited (not just voidable). This would mean that civil pecuniary penalties apply to the use of unfair contract terms in any standard form consumer or small business contract.
R 21: Prohibition on certain unfair trading practices
Amend the Competition and Consumer Act 2010 to include a prohibition on certain unfair trading practices. The scope of such a prohibition should be carefully developed such that it is sufficiently defined and targeted, with appropriate legal safeguards and guidance.
The ACCC notes the current work on this issue being undertaken as part of the Consumer Affairs Australia and New Zealand (CAANZ) process, and will progress its support for the recommendation through that forum.
R 22: Digital platforms to comply with internal dispute resolution requirements
The development of minimum internal dispute resolution standards by the ACMA to apply to
digital platforms. The standards should, among other things, set out requirements for the visibility, accessibility, responsiveness, objectivity, confidentiality and collection of information of digital platforms internal dispute resolution processes. They should also set out the processes for continual improvement, accountability, charges and resources.
All digital platforms that supply services in Australia, and have over one million monthly active users in Australia, will be required to comply with the standards. Once published, relevant digital platforms will have six months to comply with the standards. Breaches of the standards would be dealt with by the ACMA, which will be vested with appropriate investigative and information gathering powers and the capacity to impose sufficiently large sanctions for breaches to act as an effective deterrent.
R 23: Establishment of an ombudsman scheme to resolve complaints and disputes with digital platform providers
The establishment of an independent ombudsman scheme to resolve complaints and disputes between consumers and digital platforms, and businesses and digital platforms. The ACMA and the relevant ombudsman will determine the nature of complaints and disputes that would be subject to the scheme. At a minimum, it should cover complaints or disputes from businesses relating to the purchase or performance of advertising services and complaints or disputes from consumers, including in relation to scams and the removal of scam content.
The ombudsman should have the ability to compel information, make decisions that are binding on digital platforms, order compensation in appropriate cases and compel digital platforms to take down scam content.
The ACCC recommends that the ACMA and the Telecommunications Industry Ombudsman (TIO) investigate the feasibility of the TIO taking on this role. If the ACMA and the TIO conclude that it is not feasible for the TIO to undertake this role, a standalone ombudsman should be created to resolve complaints about digital platforms.
