Companies face huge fines for collecting our secrets

Tech firms could face huge fines for collecting data from browser cookies, and recording your location without consent.

Head of the ACCC Rod Simms in his Sydney office Picture: John Feder/The Australian.

Companies could face huge fines and consumer class actions for collecting data about you from browser cookies, and recording your location without consent.

The Australian Competition & Consumer Commission has recommended sweeping changes to privacy law in its report on digital platforms released yesterday.

These changes go beyond proposals by the federal government and incorporate changes recommended by the Australian Law ­Reform Commission.

The ACCC said it was aware of government plans for tougher penalties and other measures to protect online privacy. Government proposals include increased penalties of $10 million, or three times the value of any benefit obtained through the misuse of information, or 10 per cent of company annual domestic turnover.

It has backed an ALRC proposal for an offence of serious invasions of privacy. The ALRC defines the offence as including physically intruding into a person’s private space or watching, listening to or recording a person’s activities and private affairs.

In the digital age, that would impact phones recording your whereabouts without your knowledge and personal assistants such as Amazon Echo and Google Home gleaning more information about you at home than you envisaged. The original ALRC recommendation, however, was made in 2014, showing how slow the legal reform process can be.

The ACCC goes beyond these in its recommended extensions to privacy law and regulation. It wants organisations and businesses to be more accountable for the personal data they hold. It also wants consumers to have more control over their personal information, including an enforceable right to have it deleted.

Treasurer Josh Frydenberg and Communications minister Paul Fletcher discuss the release of the ACCC report into Google and Facebook in Sydney. Picture: John Feder.

The report acknowledged the need for broader reform of Australia’s privacy regime to maintain the protection of consumers’ personal information with ongoing technological change.

It wants the definition of personal data to include technical data relating to an identifiable individual. For example, this could include a fingerprint scan used to give an individual entry into an apartment block.

It wants notifications about the collection of consumers’ personal information to be “concise, intelligible and easily accessible, written in clear and plain language”.

It wants to ensure you have given consent for its collection.

That should impact the activities of those stealthy browser cookies that collect marketing and other data about you when you surf the net.

There have been occasions recorded where more than 100 ­cookies have been active as a user scans an online store. It would also prohibit the use of your email ­address for marketing where you haven’t given consent.

Platforms would have to delete personal information they hold on you when you request it, except in certain circumstances, and individuals would gain a right to launch actions and class actions against companies that interfered with their privacy.

In submissions to the inquiry, some businesses expressed major concerns about the burden such laws and regulations could bring.

For example, the Insurance Council of Australia submitted that “insurers often retain personal data after a customer no longer has a current policy with them in order to continue ser­vicing potential long tail claims”.

Facebook CEO Mark Zuckerberg at a US government hearing in Washington. Picture: AP.

The ACCC acknowledged that it would be better for this obligation to apply specifically to certain digital platforms collecting, using and sharing a large volume of personal information, and not everyone.

The ACCC said the Privacy Act needed reform to ensure consumers were adequately informed, empowered and protected, as to how their data was used and collected.

“Strengthened privacy and data protection laws can also empower consumers to make more informed choices about how their data is processed. This, in turn, is likely to increase competition between digital platforms regarding the privacy dimension of their services.”

The ACCC said it found that consumers were generally not aware of the extent of data that was collected nor how it was collected, used and shared by digital platforms. “The lack of deterrence under current laws is compounded by individual consumers’ inability to bring direct actions for breaches of their privacy under the Privacy Act or for serious invasions of their privacy that cause financial or emotional harm.”

It said some reforms should apply across the economy, not just to digital platforms. But there should be specific obligations for digital platforms’ data practices applying to notification and consent requirements, opt-out control, the handling of children’s data, information security, retention of data and complaints handling.

It wants provisions to be enforced through a Privacy Code of Practice.

Comment: Google, Facebook will have to play by the rules.