(mis)Informed Consent in Australia
Report (UNSWorks) (2021)
140 Pages Posted: 4 Jun 2021 Last revised: 21 Jun 2021
Date Written: March 31, 2021
"I’m not comfortable with them having any of my information, but if you want to be involved in whatever the site is about, you don’t get options…"
"I don’t know how I can decipher where my data goes and how it’s used. It concerns me, but it’s not transparent to me."
"I expect law to deal with that."
These consumer comments reflect some of the major issues facing consumers in Australia, New Zealand and worldwide. It is trite to say that digital platforms have become ubiquitous, with the likes of Google, Facebook, Microsoft and Apple attempting to influence many people’s day-to-day activities, in both the personal and professional spheres. Such platforms offer several beneficial services, and many require no monetary payment on the condition that users consent to their data being collected, processed and used for the commercial purposes of third parties. However, this ‘consent’ usually involves a consumer accepting or agreeing to a set of take-it-or-leave it standard form terms, giving consumers essentially no choice but to submit to a wide range of data practices if they wish to access a product or service.
It is clear that consumers expect the law to protect them when it comes to how data is collected, shared and used. This report explores the notion of ‘informed consent’ in relation to commercial dealings with consumer data and its effectiveness to appropriately protect individuals under the law in Australia. It discusses aspects of informed consent in the context of the current legislative and regulatory framework regulating such dealings, and recommends changes to regulatory and legislative frameworks that deal with consumer data handling and standard form agreements.
This report sets out the research and critical analysis of three UNSW scholars, from the School of Global and Public Law, School of Management and Governance, and School of Private and Commercial Law in the Faculties of Business and Law & Justice. Each of these scholars provides their own unique insights relating to the interdependencies between the law, current business practices, consumer expectations, economic, social and behavioural considerations in the context of notions of informed consent and standard form agreements.
In exploring these issues, these scholars have explored the legislative frameworks created by the Privacy Act 1988 (Cth) and the Competition and Consumer Act 2010 (Cth), and also considered the impact of Australia’s regulatory framework, including enforcement practices of the OAIC and the ACCC.
In Chapter 1, Dr Manwaring outlines the empirical evidence in Australia regarding consumer privacy expectations as to commercial dealings with their data, and introduces Australia’s data protection legislative framework. In Chapter 2 she proceeds to examine in detail issues with the legislative framework meeting consumer expectations in relation to informed consent, particularly in relation to the Privacy Act and the Australian Consumer Law. She also briefly examines the approach in other relevant jurisdictions for their utility in informing reform in the Australian context. However, Dr Manwaring concludes that none of those jurisdictions appears to have fully solved the problems posed by informed consent and standard form agreements.
However, the legislative framework only poses part of the problem. In Chapter 3, Dr Kemp outlines issues with the regulatory framework supporting enforcement, including the operation of the enforcement and other powers of the main regulators of consumer data, the Office of the Australian Information Commissioner (OAIC) and the Australian Competition and Consumer Commission (ACCC). Dr Kemp concludes with proposals on necessary reforms.
In Chapter 4, Dr Nicholls examines economic, social and behavioural aspects of privacy and consumer protection policy approaches to standard form agreements and informed consent.
In Chapter 5, Dr Kemp provides a ‘deep dive’ into regulation of an area of growing concern, that of the data brokerage and adtech industries. These industries are characterised both by their growing influence and the obscurity of the data collection, processing and transfer practices employed in them, and the consequent near-invisibility of their practices to the consumers whose data drives their profits. Dr Kemp recommends a set of reforms to offset some of the harms posed by the practices of data brokers and adtech providers.
In Chapter 6, Dr Nicholls reviews the recent reform which introduced the Consumer Data Right, the proposals for reform contained in the Digital Platforms Inquiry, and the limitations of the current policy, regulatory and legislative regime. He examines the potential for general reform of these frameworks in relation to standard form agreements and the protection of consumers in relation to the collection and handling of their data by commercial entities and recommends both ‘quick wins’ and systemic long-term change.
The date of this report is 31 March 2021. However, on 16 April 2021, the Federal Court handed down a judgment which found that Google LLC and Google Australia Ltd had misled consumers about location data collected through mobile devices. Penalties are yet to be determined, but nevertheless this judgment is likely to prove an important development in how judges and businesses interpret privacy and consent requirements. Therefore, we have included a brief ‘stop press’ about this decision in Appendix A to this report (by Dr Kemp and Dr Manwaring).
The adequacy of the Privacy Act to protect data subjects has been vigorously and routinely contested. Commercial entities face few substantial barriers in dealing with consumer data (other than compliance costs, which are likely exacerbated by the nature of the legislation). In many cases consent of consumers is not required, and even where it is, the nominal consumer consent obtained is not informed, is non-negotiable, and is subject to unilateral interpretation and extension at the will of the commercial party.
While consumer protection law can potentially provide a more fertile area to protect consumers against the problems of a lack of true informed consent, there are significant gaps also in this framework.
With this report, we hope to draw greater attention to the problems with informed consent, the use of standard form agreements, the activities of data brokers and adtech providers, and to advocate for greater protection in respect of commercial dealings with consumer data.
Keywords: privacy; data protection; consent
Suggested Citation: Suggested Citation