On 29 July 2019, the Australian Competition and Consumer Commission (ACCC) released its final report of the Digital Platforms Inquiry. The report made 23 recommendations across a number of areas including privacy, competition, and consumer protection, reflecting the broad issues that have arisen from the growth of digital platforms.

Although the report was focused on digital platforms such as Facebook and Google, the ACCC was clear that some of its criticisms extended beyond the realm of large digital platforms and are applicable to all businesses with an online presence.

This should be a warning signal to New Zealand businesses. Although this was an Australian report, the New Zealand Commerce Commission has already taken notice of its findings in the context of privacy policies. This therefore begs the question, what else could our regulator be looking at as a result of the ACCC’s report?

Click-wrap agreements

Click-wrap agreements are agreements where a user takes some kind of affirmative action such as ticking a box stating “I accept” to a website’s terms and condition. They are regularly used by digital platforms to enable users to create an account and to sign up to their ‘free’ services.

The ACCC reviewed a number of these agreements and was critical of the extent to which they purposely bundled a wide range of terms and conditions into one blanket tick box, without asking consumers to review any of the relevant terms of service or privacy policies. For example, Facebook’s sign-up page states that by signing-up, a user agrees to their terms and conditions, data policy and cookie policy. These criticisms could easily apply to other businesses’ online systems for signing up to terms and conditions.

Click-wrap agreements can also deem a user’s consent to multiple separate agreements, including some which may change over time. This means that when a user signs up to the terms of agreement, they may also be signing up to other policies (such as privacy policies) which many of the digital platforms vary unilaterally.

So why is this of concern to regulators?

The ACCC considered that presenting consumers with ‘free’ services such as Facebook or Twitter and bundling consents within a ‘click-wrap form’, exploits “behavioural biases”. As a result consumers may be providing consent to terms and conditions that they have not reviewed, and may not be considering the potential consequences of providing their user data. The ACCC found that only 20% of users reported that they read the privacy policies or terms of use for online sites or apps most times or every time, whereas 60% of users indicated that they rarely or never did so. The ACCC also expressly noted that “some features of these problematic consent processes extend beyond the data practices of digital platforms to other sectors across the economy”.

Although the ACCC report did not expressly cover this, there are a number of common terms used by digital platforms and other online businesses which could be unfair contract terms. The Commerce Commission has previously indicated that contract terms, such as asking a consumer to confirm they have “fully read and understood” the terms and conditions, could be an unfair contract term. The ACCC has also identified the right to unilaterally vary terms as a potential unfair contract term. A term is not unfair, however, if the term is reasonably necessary to protect a legitimate interest. Any business with these kinds of terms should be ready to justify that legitimate interest in detail or, if not, should consider whether it should alter its terms. This is particularly of note as online contracts are already a focus area for the Commerce Commission, as they recently commenced proceedings against prominent online ticket reseller, Viagogo, for unfair contract terms.

Representations regarding a consumer’s control over their data

The ACCC was sceptical of the actual control users have over their data, particularly given that many digital platforms give “reassurances” that their users have ultimate control over their data. For example, Facebook’s first privacy principle on its web page states: ‘We give you control of your privacy – You should be able to make the privacy choices that are right for you…’.

So why the scepticism? The ACCC noted that there is simply no incentive for large digital platforms such as Facebook to encourage consumers to opt-out of their collection, use or disclosure of user data, but that there is an incentive for digital platforms to “convey an impression” that consumers have control over their data.  The ACCC referred to research which showed that the impression that a user has control over their data increases that user’s likelihood of disclosing more sensitive information, which benefits digital platforms in a number of ways, such as allowing more targeted advertising.

The Commerce Commission is likely to look closely at the data practices of businesses to ensure that they are accurately representing the control that users have over their data. To the extent, the representations are misleading or cannot be substantiated, the Commission may look to take action. This focus is only set to increase if the Government’s recent announcement that they intend to introduce the concept of “unconscionable conduct” into the Fair Trading Act is adopted.

What are the key takeaways for businesses operating in New Zealand?

Clearly the Commerce Commission is already taking note of some of the ACCC’s recommendations around privacy policies and applying them in New Zealand. They will also be looking closely at the other issues identified above. So what can businesses do to safeguard themselves against some other potential future focuses of the Commerce Commission?

• consider unbundling – keep your terms and conditions, privacy policies and any other policies separate to the extent you can and seek separate agreement to each;
• stay clear of terms that allow you to unilaterally change your terms and conditions or privacy policies and have your terms reviewed to check for potentially unfair contract terms;
• have clear and unambiguous terms and conditions – make sure your terms are succinct, clear and easy to read;
• check your representations – what do your terms and conditions say about how you deal with a user’s information? Is this how you operate in practice?  What about your other representations made in your terms? Are they accurate?  It is particularly important to revisit these questions as new technology changes or as your businesses processes change.