The ACCC has released Digital Platform Services Inquiry – March 2024 report on data brokers Issues Paper which states
The purpose of this Issues Paper is to invite written submissions from interested parties to assist the ACCC in understanding the nature of the data broker industry in Australia and any related competition and consumer issues that may arise.
The role of data brokers
As we continue to spend more of our time online, Australians are generating an ever- increasing amount of data. As noted by the Organisation for Economic Co-operation and Development (OECD), ‘the digital transformation is changing economies and societies, powered partly by the collection and use of ever-growing quantities of consumer data.’ According to a 2019 McKinsey Global Survey, 47% of respondents said that data and analytics have significantly or fundamentally changed the nature of competition in their industries over the previous 3 years. In many markets, access to large volumes of high- quality personal data is essential for businesses to compete. Where businesses have unique access to such data, this can provide them with a significant competitive advantage. Conversely, not having access to such data can be a significant barrier to entry and expansion. For example, McKinsey’s 2019 research found that businesses reporting the greatest growth in revenue and earnings received a significant proportion of that boost from data and analytics, with high-performing organisations 3 times more likely than others to say their data and analytics initiatives had contributed at least 20% to earnings before interest and taxes over the previous 3 years.
What is a data broker?
Data brokers are a key part of the data supply chain that fuels a range of online and offline products and services. The Direction for the Inquiry defines a data broker as ‘a supplier who collects personal or other information on persons, and sells this information to, or shares this information with, others.’6 Hence, for the purposes of the Report, we will focus on data brokers that collect, process and analyse ‘personal or other information on persons.’ ...
By combining information acquired from a range of sources, data brokers are able to develop and monetise new proprietary data products and services. These data products and services include tools and reports prepared for a variety of purposes such as customer profiling, marketing, risk management, consumer credit reports or scores, and fraud or crime prevention. The Final Report of the ACCC’s Digital Platforms Inquiry (the DPI Report), discussed the role of data brokers, observing that they ‘have a central role in exchanging and combining personal information and data across a wide variety of sectors in Australia.’
Despite the central role that data brokers play in providing data products and services to a range of businesses, as well as the wide variety and volume of information that they collect, analyse and process, there is currently little transparency, awareness and understanding of how data brokers operate in Australia.
Many consumers are not aware that businesses such as data brokers collect their information, nor have an understanding about how or when such information is collected, or what is being done with this information. In addition, many consumers appear to be uncomfortable with the kinds of data-handling practices used by businesses such as data brokers. A recent survey by the Consumer Policy Research Centre found that 74% of Australians were not comfortable with companies sharing or selling their personal information, and less than 10% were comfortable with targeted advertising based on the tracking of online behaviour or personal characteristics without express permission. Despite these consumer sentiments, current trends in data collection and analysis suggest that the role of data brokers is likely to increase.
Overseas jurisdictions, including the United States, the United Kingdom and Canada, have previously examined the role of data brokers and identified concerns with their practices. The ACCC will draw on relevant literature and reports both in Australia and overseas for the purpose of this Report.
Proposed focus
Data brokers can be broadly split into two categories:
▪ businesses that collect data on their own consumers and sell or share that data with others (first-party data brokers), and
▪ businesses that collect data about consumers from a range of third-party sources and sell or share that data with others (third-party data brokers).
The ACCC has previously examined how digital platforms use the first-party data they collect from their users in providing digital platform services. We have also looked at some examples of businesses that share or sell first-party data to others. However, we have not yet examined the data collection, storage, supply, processing and analysis services supplied by businesses who sell or share information that is predominately collected from a variety of other sources, (i.e. third-party data brokers). Third-party data brokers typically add value to the data they collect by applying sophisticated and proprietary analysis to it, which is then used to develop data products and services sold or licensed to businesses that might not otherwise have the in-house capacity or resources to undertake this themselves.
Unlike first-party data brokers, third-party data brokers do not have a direct relationship with the consumers on whom they collect, process and analyse information. This raises unique consumer protection issues, since consumers are less likely to: ▪ be aware of these practices ▪ have explicitly consented to the collection and use of their data, and ▪ be able to challenge or opt out of the collection and use of their data.
The ACCC proposes to focus predominantly on third-party data brokers for the purposes of the Report.
Market dynamics
The ACCC’s preliminary analysis has identified a number of data products and services supplied by third-party data brokers operating in Australia, including: • Customer and audience profiling and tracking products and services, including marketing and advertising campaign measurement, audience profiling and tracking, media planning, and marketing optimisation. • Property data analytics products and services, including housing affordability reports, construction reports, sales and auction result data and valuation models. • Retail data analysis products and services, including consumer purchasing data, which can be used for pricing, marketing, inventory and optimisation strategies. • Risk and fraud management products and services, including for use in insurance and tenancy applications. • Data validation, cleansing and enriching services. • Identity verification services.
Another key category of data products and services supplied by third-party data brokers in Australia is consumer and commercial credit reporting products and services, including the supply of credit reports and scores. While the provision of these products and services may raise similar competition or consumer issues to the other products and services supplied by third-party data brokers, we do not propose to focus on these specific offerings as they are regulated separately under the Privacy Act 1988 (Cth).
We understand that the types of products and services identified above are provided by a range of entities that collect information, including the following third-party data brokers in Australia:
• CoreLogic: is a property data and analytics company that produces a range of products including housing affordability reports, construction reports, sales and auction result data and valuation models. Customers include businesses involved in commercial and residential real estate, banking and finance, and construction, as well as the public sector. CoreLogic operates in 9 locations across Australia, New Zealand, the United States and the United Kingdom, and reportedly has data on over 14 million properties across Australia and New Zealand. Its annual Australian revenue in the year ending 31 December 2020 was $169.5 million.
• Equifax: provides ‘insights’ and sells ‘products’ and ‘solutions’ on a range of issues to small businesses and business and enterprise customers. It operates in 24 countries worldwide, providing insights on over 820 million consumers and 91 million businesses. It moved into Australia when it acquired Veda in 2016. In 2021, Equifax Australia Holdings generated revenue of $435 million in Australia. To the extent that Equifax is also a credit reporting body in Australia, we are not proposing to inquire into its credit reporting activities, which are regulated under Australian privacy law.
• Experian: provides a range of ‘business solutions’ and ‘insights’ services to business users, including a range of data and analytics tools to serve a range of purposes, including marketing, risk management and data validation. It is a global company, operating across 30 countries. Experian Australia Holdings generated $74.6 million in revenue in Australia in 2021.
• Illion: provides data and analysis products and services, including risk management and marketing solutions and access to varied ‘data registries.’ Illion is a part of the Dun & Bradstreet Worldwide Network. In 2015, its Australian and New Zealand operations were sold to Archer Capital for $220 million, which was rebranded as illion in 2018.
• LiveRamp: operates across the globe from 13 offices and has over 900 business customers. LiveRamp provides data tools and analysis to support customer and audience profiling and tracking, as well as marketing and advertising campaign measurement. LiveRamp was acquired by Acxiom, then a data broker, in 2014. In 2018, Acxiom sold its marketing business (now known as Acxiom Marketing Solutions) and rebranded its data broking business as LiveRamp.
• Nielsen: is a market research, data and analytics company that offers audience measurement, media planning, marketing optimisation and content metadata services in Australia. Nielsen operates in more than 55 countries. It earned US$3.5 billion (approximately AU$5.27 billion) in global revenue over the year to December 2021. In 2022, its Australian revenue reached $42 million.
• Oracle: is a provider of cloud applications and cloud infrastructure services. It also operates a third-party data marketplace, which offers ‘actionable audience data' on over 300 million consumers, as well as an ‘ID Graph’ service, which allows advertisers to combine data on individuals across multiple devices. Oracle’s annual Australian revenue in the year ending 31 May 2021 was $116.2 million.
• PropTrack: is owned by REA Group and offers ‘data and insights powered by REA Group’ in relation to banking and lending, collateral risk, and real estate. PropTrack is headquartered in Australia and operates in 7 other countries. The REA Group also includes consumer-facing services such as realestate.com.au, flatmates.com.au and Mortgage Choice. The REA Group reported $1.17 billion in revenue over the 2021/22 financial year, including $97 million in the ‘media, data and other’ category.
• Quantium: offers a range of data science services, including data cleansing, curation and monetisation. It also offers the ‘Q.Checkout’ platform, with insights into an estimated 10 million Australian consumers via Woolworths data, while its CommBank iQ service, a joint venture with Commonwealth Bank, offers access to ‘Australia’s largest aggregated and de-identified transaction banking dataset.’ Quantium was founded in 2002 and now operates across 11 offices worldwide. Woolworths Group acquired a majority stake in Quantium in 2021. In December 2022, Quantium and Telstra announced a new data and AI joint venture.
The ACCC acknowledges that these businesses offer a wide range of products and services, including some offerings that may not directly involve the use of personal or other information on persons. The ACCC has previously engaged some of these businesses in the course of our work. The ACCC is interested in the level of competition between third-party data brokers and other businesses in Australia, and invites submissions on this issue. In particular, we invite any general observations on the level of competition, including what factors drive competition, as well as identification of any specific barriers to effective competition in the provision of data products and services.
Questions
1) Who are the databrokers operating in Australia that predominantly collect informationf rom other sources (i.e., not directly from consumers)?
2) How do data brokers compete? What factors do data brokers differentiate themselves on (e.g., price, range of data, specific types of data, analysis undertaken, additional services offered)?
3) How difficult is it for new data brokers to enter the Australian market? What are their entry strategies (e.g., expansion of overseas data brokers into Australia, expansion of other businesses into data broking, new entrants)? Does this differ depending on the types of data products or services provided?
4) What are the benefits of data brokers? Who do they benefit? Does this vary by data broker? If so, how?
Questions for customers of data brokers
5) What factors do you consider when choosing which data broker to acquire products or services from?
Data collection and sources
The ACCC understands that third-party data brokers collect information from a range of sources, including: • digital platforms, including social media services • web pages (through web scraping) • the use of website cookies • app developers, including through the use of software development kits (SDKs) • other businesses (such as banks, retailers and telecommunications companies) • open data projects • government sources (such as the electoral roll, ASIC databases, and land titles offices) • customer loyalty schemes • other data brokers.
From these sources, data brokers collect a range of information. For example, this could include an individual’s name, home and work address, date of birth, marital or family status, education level, income, purchasing history, search and browsing habits, location data, and financial information.
The ACCC is interested in understanding more about how data brokers collect information. Stakeholder feedback in response to the below questions will help us better understand industry practices and identify any potential consumer or competition issues.
6) What information do data brokers collect? For each type of information, provide details of: a) How this information is collected, including details of any technologies used (e.g., tracking scripts, web-based plug-ins, tracking pixels, or SDKs in apps). b) Where or from whom this information is collected. c) The terms and conditions under which the data is collected. d) Any prices or fees paid for the information, including details of how these are determined.
7) Are there any particularly important or must-have sources of information for data brokers to collect? If so, what are they and who supplies these (e.g., digital platforms)?
Questions for businesses that sell data to data brokers
8) What information do you sell or provide to databrokers? a) To which databrokers?Do you provide or sell the data to multiple databrokers? Whyor why not? b) Under what terms and conditions (including price) do you sell this data? Is this done via tender, negotiated contracts, take-it-or-leave-it list prices, or other means? c) How do you collect this data? d) Do you know how this data is used? Do you have any control over this?
9) What other types of businesses (non-data brokers) do you sell or provide data to?
Data products and services
The ACCC is particularly interested in the development and supply of data products and services by data brokers to other users. Examples of the types of products and services offered by data brokers include tools and reports developed and used for a range of purposes, including customer profiling, consumer credit scores, marketing, risk management and fraud or crime prevention, as discussed above. The ACCC seeks views from stakeholders on how data brokers use the data they collect. For example, we seek to better understand how data brokers process and analyse data, the specific products and services they offer, who uses these products and services, what they are used for, and the terms and conditions that may apply to their supply and use.
10)What are the business models used by data brokers? How do they monetise their services?
11) What types of data products and services are offered by data brokers? a) Who acquires these? b) How and for what purposes are these used? c) What terms and conditions (including restrictions) typically apply to their use?
Questions for business users of data products and services
12) What products and services have you acquired from data brokers? a) From which databroker(s)? b) Were these bespoke or ‘off-the-shelf’ products? c) Under what terms and conditions (including price) did you acquire these products and services? Was this done via tender, negotiated contracts, take-it-or-leave-it list prices, or other means? d) What did you use these products and services for? e) What terms and conditions or restrictions govern or governed the use of these products or services?
13) Are there any ‘must-have’ data products or services that you acquire from data brokers? Are these available from multiple data brokers? If you were unable to acquire these from a data broker, how else could they be acquired?
14) How important are data brokers for the provision of digital platform services? For example, in addressing data-related barriers to entry. Why?
15) How do the products and services provided by data brokers affect competition in other markets? For example, in markets where businesses may supply data to data brokers, or in markets where businesses acquire products and services from data brokers in order to provide their own products and services. If the products and services provided by data brokers do affect competition in other markets, how?
Potential consumer and small business harms
The ACCC is seeking views on potential consumer and small business harms and benefits associated with the collection, processing and analysis of information by data brokers. The ACCC has previously identified a range of potential harms relating to the collection and use of personal information or data, including harms associated with:
• Direct marketing practices, including customer profiling, personalised pricing or pre-quoting, and potentially harmful targeted advertising.
• Use of information in ways that discriminate against a consumer, or in ways not anticipated by the consumer. For example, a consumer’s personal details shared in another context being used to influence their access to rental housing.
• Incomplete or inaccurate data being used to develop a profile of a consumer. For example, consumers may be unable to complete important transactions, such as opening a bank or mobile phone account, if the data included in a risk mitigation product is incorrect and identifies them as a risk on the basis of the incorrect information.
• The misuse of personal or other information on persons obtained by malicious actors. For example, products that identify an individual’s home address or place of work may be used to facilitate harassment or stalking, and may expose domestic and family violence victims, law enforcement officers, prosecutors, public officials or other individuals to retaliation or harm. Personal information could also be misused by malicious actors to perpetuate scams.
• Misleading terms and conditions or inadequate disclosures about how information is shared with data brokers, including the use of clickwrap agreements, which use digital prompts that request users to provide their consent to online terms and policies, without requiring them to fully engage.
As consumers are generally unaware of data brokers and their business practices, we are concerned there may also be a general lack of awareness about the potential harms related to these practices. While the practices of data brokers may also raise privacy-related harms, this Report will not review the operation of Australian privacy laws, which is outside the scope of the Inquiry.
16) What benefits do data broker products and services provide to consumers and small businesses?
17) What consumer harms may arise from the collection, processing, analysis or storage of information by data brokers? Which consumers are most likely to be harmed and why?
18) What consumer harms may arise from the use of data products and services sold or provided by data brokers? Which consumers are most likely to be harmed and why?
19) What processes and controls do data brokers have in place to protect consumers? This may include efforts around the de-identification and aggregation of data, data verification processes to ensure data is accurate, or measures to protect stored data. a) Are these controls adequate? What more could/should be done?
20) To what extent are consumers aware that their data is being collected and used by data brokers? How are they are made aware?
21) What steps can consumers currently take to inspect and/or remove the data that is held about them or to otherwise raise a complaint with data brokers?
22) What bodies or resources exist to assist and support consumers in their dealings with data brokers? What more could be done to better educate and empower consumers?
Question for consumers
23) Have you experienced any harm, including financial loss or differential treatment, as a result of a product or service provided by a data broker? What actions were open to you to try and address the issue, and was it resolved?
