ACCC fines Meta … two cops on the privacy beat
In July 2023, the Australian Federal Court ordered two subsidiaries of social media giant Meta (formerly known as Facebook), Facebook Israel and Onavo Inc, to each pay A$10 million for engaging in conduct liable to mislead in breach of the Australian Consumer Law, in an action brought by the ACCC.
The old adage about software and apps, that if you’re not paying for it, you’re the product, was given spectacular endorsement by Justice Abraham in finding that Meta Group companies had misled and deceived Australian consumers in relation to their data processing activities.
Even before this recent decision the ACCC has been active – with the Google cases, the 2022 initiated stoush also with Meta about misleading and deceptive conduct in publishing advertisements on Facebook promoting scam cryptocurrency, enforcement proceedings against Trivago, Uber, Airbnb Ireland and their ilk, and the ongoing Digital Platform Services Inquiry.
Fining Meta is another instance of the ACCC determination to protect Australian consumers from the sharper edges of the social media industry.
What happened?
The fine related to a ‘free’ app supplied by Meta that provided a VPN service which claimed to protect personal information but which was found to have collected user data for commercial purposes.
Onavo Protect was advertised as being supplied to “keep you and your data safe online” and give users “peace of mind when you browse”. Users were assured their data would not be used for any purpose other than providing Onavo Protect’s products. That wasn’t true: in a ‘fox in the hen house’ kind of twist, Meta used the app to do exactly that which the users feared. The app tracked users’ online activity comprehensively and collected details about users’ mobile device and their location and then used that potent brew of data for advertising and marketing activities.
ACCC warns about transparency
Yes, buried somewhere in the hocus pocus, in the Terms of Service and Privacy Policy to be exact, were details of the commercial contexts in which Meta intended to exploit the harvested personal information. But Justice Abraham wasn’t having it: she found those disclosures were “not sufficiently prominent or proximate” compared to the headline claims about data safety and data protection in its app store listings.
Meta clearly had not learnt the lessons from Australian Competition and Consumer Commission v Google LLC (No 2) in which the Federal Court, relying heavily on the use of expert evidence in the field of behavioural economics, came to pretty much the same decision when presented with pretty much the same scenario.
The Onavo Protect app is no longer available on the App Store or Google Play Store.
Remembering that, in March 2023, the Full Court of the High Court of Australia finally allowed the OAIC to proceed in the Federal Court against Meta/Facebook in relation to Cambridge Analytica matter, it is becoming more apparent that there are two active regulators in the digital services and platforms arena – the OAIC and the ACCC. The Australian Information Commissioner and Privacy Commissioner Angelene Falk welcomed the High Court decision as “an important step in ensuring that global digital platforms can be held to account when processing the personal information of Australians.”
But it’s about all so much more than just that …
The ACCC protecting consumer’s interests
The ACCC’s role in calling digital services and platforms providers to account looks towards a broader regulatory focus on truth in advertising, consumer protection, market dynamics and supplier behaviour in the online paradigm.
The ACCC’s intervention in the Onavo Protect app is a welcome reminder that there is much more to the regulation of data processing and the digital environment that just the privacy perspective.
The European Union Digital Markets Act, focussed on regulating misuse of market power by the big digital gatekeepers, and the European Digital Services Act, to create a safer digital space in which the fundamental rights of all users of digital services are protected, are both good expositions of the broader scope of regulation necessary to ensure that the digital environment doesn’t take on, with all due respect to Thomas Hobbes, the “solitary, poor, nasty, brutish, and short” attributes of a life in the state of nature.
If only the Australian government was as proactive …
