In a decision handed down on 16 April 2021, the Federal Court of Australia found that Google LLC and Google Australia Pty Ltd (Google) misled some users of Android devices about the collection of their personal location data over a two year period.
What Happened?
The Australian Competition and Consumer Commission (ACCC) commenced proceedings against Google in 2019, alleging that Google had contravened various provisions of the Australian Consumer Law (ACL) relating to misleading and deceptive conduct. In particular, the ACCC alleged that between January 2017 and December 2018, certain users of mobile devices with Android operating systems were misled about Google’s collection and use of their location data by reason of the content of various screens those users saw on their devices.
Two settings were critical to the ACCC’s case: “Web & App Activity” and “Location History”. The ACCC alleged that there were users who, acting reasonably, would have been led into thinking that, with Location History “off”, Google would not obtain, retain and use personal data about a user’s location. However, in fact, users also needed to navigate to another setting – “Web & App Activity” – and then select “Don’t save my Web & App Activity to my Google Account” in order to prevent location data from being saved to their Google account. In short, unless users turned both settings off, Google would continue to collect and use their personal location data – and the ACCC alleged that this was not made clear to users during the relevant two year period.
By failing to make it clear that “Location History” was not the only setting relevant to Google’s collection and use of location data, the Federal Court found that Google had misled some users and had contravened a number of provisions of the ACL. The ACCC is seeking declarations, pecuniary penalties, publications orders, and compliance orders against Google. These penalties and other orders will be determined by the Federal Court at a later date.
What Does This Mean for You?
The Court’s decision demonstrates the importance of transparency when companies notify consumers about their collection and use of location information, as well as personal information more generally.
Following the Court’s decision, ACCC Chairman Rod Sims said:
“Today’s decision is an important step to make sure digital platforms are up front with consumers about what is happening with their data and what they can do to protect it. …
“Companies that collect information must explain their settings clearly and transparently so consumers are not misled. Consumers should not be kept in the dark when it comes to the collection of their personal location data.”
Moving forward, companies that collect, use and/or disclose user data and personal information via a digital platform should ensure that their terms of use, collection notices and privacy policies clearly explain the effect of disabling or enabling various settings, so that users are fully informed about the fate of their data and the options available to them to protect it.
The Interaction Between Consumer Protection and Data Privacy
While the ACCC’s core function is to protect and enforce competition and consumer protection legislation, the ACCC’s proceedings against Google – and the Court’s findings – demonstrate the important interaction between consumer protection and data privacy protection.
Indeed, data privacy appears to be an area of increasing interest for the ACCC. In 2019, the ACCC commenced proceedings against HealthEngine, the operator of a website that allows users to book medical appointments. One aspect of the ACCC’s case was that HealthEngine did not make it adequately clear on its website that, if a user agreed to be contacted about health insurance, that user’s personal information would be sent to a third party insurance broker. HealthEngine admitted certain contraventions of the ACL and was ordered to pay a penalty of $2.9 million in total ($1.4 million of which related to the broker referrals). You can read our article about the HealthEngine case click here.
The ACCC has also commenced separate proceedings in the Federal Court against Google LLC, alleging that it misled Australian consumers when it failed to properly inform them about its plans to start combining personal information in consumers’ Google accounts with information about those individuals’ activities on non-Google sites that used Google technology to display ads. The ACCC is also alleging that Google misled consumers about a related change to its privacy policy.
These recent cases demonstrate the emergence of the ACCC as an active regulator in relation to privacy and data protection issues, insofar as those issues give rise to consumer protection concerns.
How We Can Help
We routinely advise businesses that operate online platforms on their compliance obligations under the ACL and the Privacy Act. If you have any questions specific to your business and its activities, please do not hesitate to give one of our team a call.