Search for:

The boundary between consumer protection and privacy regulation is being scrutinised and challenged by the Australian Competition and Consumer Commission (ACCC), as the collection and use of customer information plays an increasingly important role in customer service and profitability.

This week, the ACCC commenced proceedings against the online health booking platform HealthEngine Pty Ltd (HealthEngine) for misleading and deceptive conduct relating to the sharing of patient’s personal information with different third party insurance brokers, as well as other allegations concerning the publishing of patient reviews and ratings.

The ACCC alleges that HealthEngine provided the personal information of over 135,000 patients across a four year period to private health insurance brokers in return for a fee without prior adequate disclosure of this to the relevant patients. The personal information disclosed included patient’s names, email addresses, phone numbers, and date of birth.

The ACCC alleges that patients were not adequately informed that their personal information would be disclosed to third parties in return for a fee, and alleges that those patients whose personal information was disclosed to the third party insurance brokers were ultimately misled into believing that their personal information would remain secure and only held by HealthEngine.

Following on from the ACCC’s heavy involvement in the Consumer Data Right law and its recent Digital Platforms Inquiry Final Report, it is clear that one of the ACCC’s top priorities moving forward is the importance of consumers being able to make fully informed choices concerning the handling of their personal information by different businesses in Australia.

The ACCC has clearly expressed their desire to reform Australia’s data protections laws in its Digital Platforms Inquiry Final Report to ensure that consumers have more informed choice over the handling and disclosure of their personal information by businesses:

    “The ACCC notes that, since the Privacy Act was passed 30 years ago, the Internet and digitalisation have radically altered the ways in which businesses and consumers interact and exchange personal information. Numerous amendments have been made to the Privacy Act, but these incremental changes may not be sufficient to address the volume and significance of privacy and data protection issues proliferating in the digital economy. The data practices of digital platforms considered in this chapter demonstrate some significant gaps in Australian privacy laws.” (page 437)

For the ACCC, the handling and disclosure of personal information is not limited to the Privacy Act 1988 (Cth) (Privacy Act). The ACCC considers that there are wider consumer welfare issues arising from the increased collection and use of consumers’ personal information. As a result, in addition to the recommendations to strengthen consent and notification requirements under the Privacy Act, the recommendations in the Digital Platforms Inquiry Final Report also include proposed amendments to the Australian Consumer Law.

To read more on the Digital Platforms Inquiry Final Report, click here.

The ACCC’s position on the collection and use of personal information is consistent with views of the Federal Communications Commission in the USA which has for decades taken action to enforce representations made in relation to the collection and use of customer information as a component of consumer protection regulation.

In addition to the obligations under the Privacy Act concerning the appropriate collection, use, storage and disclosure of personal information, the case against Health Engine and the Digital Platforms Inquiry Final Report demonstrate that businesses must be conscious of the fact that the ACCC considers that businesses operating in Australia will fall foul of the Australian Consumer Law if they are not transparent as to how they collect and use consumers’ personal data.

To ensure that consumers are adequately informed of the handling and use of their personal information, businesses should ensure that they have adequate privacy policies in place which are not overly complex, long, vague or difficult to navigate.

Author

Anne-Maree Harnett is an associate in Baker McKenzie Sydney office.

Author

Andrew Stewart heads the Australian Media & Content Group and serves as member of the Global Media Steering Committee of Baker McKenzie. A partner since 2007, Andrew is also a member of the Australian Dispute Resolution, Intellectual Property and Technology, Communications & Commercial practice groups. Andrew also has significant in-house experience in one of Australia’s most successful television networks, giving him an insight into the media environment in Australia. He is a committee member of the Communication and Media Lawyers Association of Australia, and is an advisory board member of the Melbourne University Centre for Media and Communications in the Law. He also serves as secretary of the International Institute of Communication, Australian Chapter.

Author

Allison Manvell is a special counsel in the Technology, Communications and Commercial, and Media & Content, teams at Baker McKenzie. Allison works across Baker McKenzie's Sydney and Brisbane offices. Allison has more than ten years' experience advising on commercial and regulatory matters across a range of industries with a particular focus on digital media, technology, broadcasting and content licensing and regulation. Allison has also spent time on client secondment within the media industry. She is a member of the Communications and Media Law Association and she speaks and presents regularly on legal issues relevant to convergence and digital media.

Author

Anne-Marie Allgrove is a partner in the Sydney office of Baker McKenzie. She is also the Global Chair of the Firm’s Technology, Media and Telecommunications Industry Group and Practice Group and is recognised in both Chambers and The Legal 500 as a leading individual.

Author

Patrick Fair practices in telecommunications, information technology and intellectual property. His experience covers information security, privacy, online content regulation, telecommunications regulation and broadcasting law.

Author

Georgina Foster is a partner in Baker McKenzie's Sydney office and leads the Firm’s Australian competition practice.

Author