The ACCC continues its push on personal information

The recommendations in the ACCC’s final report on loyalty schemes have implications for all businesses that collect and use personal information

The Australian Competition and Consumer Commission (ACCC) has released the final report and recommendations coming out of its market study into customer loyalty schemes.

The ACCC self-initiated the study after announcing that loyalty schemes was one of its compliance and enforcement priorities for 2019. The ACCC decided to focus on loyalty schemes in light of the number of complaints made against them and concerns about the way in which they collect, use and disclose members’ personal information.

Through the study, the ACCC identified a number of consumer and privacy concerns and made 5 recommendations to address these concerns. The ACCC considers that it has put the loyalty scheme industry on notice, particularly concerning their data practices. It has not yet announced any competition or consumer law enforcement action against loyalty schemes. However, it is continuing to encourage consumers to report concerns and operators and participants of loyalty schemes should therefore expect ongoing scrutiny of their practices.

More broadly, the concerns and recommendations identified by the ACCC in this market study have implications for all businesses (not just loyalty schemes) that collect and use personal information. This report reinforces the recommendations made by the ACCC in relation to data, privacy and consumer law in the Digital Platforms Inquiry.

This is part of the ACCC’s continued push to achieve cross-industry reform of data practices by highlighting concerns, taking enforcement action under existing consumer and competition laws and lobbying for law reform aimed at increasing the ability for the ACCC and other regulators to take such action.

In this note we:

• summarise the ACCC’s concerns and recommendations relating specifically to loyalty schemes; and
• provide guidance on their implications for all businesses that collect and use personal information.

Consumer and privacy concerns and recommendations

The ACCC’s consumer and privacy concerns centre on the level of transparency around the terms and conditions of customer loyalty schemes, particularly in relation to:

• the earning, expiry and redemption of points; and
• the use, collection and disclosure of personal information.

The ACCC’s concern is that these terms are not transparent and that consumers are therefore unable to make informed decisions around the benefits of loyalty schemes and the provision of their data to those schemes.

These concerns echo the issues raised in the ACCC’s Digital Platforms Inquiry regarding the lack of public awareness concerning how consumer data is used by companies, particularly where this information is contained in lengthy and complex privacy policies.

To address these issues, the ACCC made the following recommendations.

Recommendation 1: Improve how loyalty schemes communicate with customers

The ACCC recommends that consumers should be given a genuine opportunity to review the terms and conditions of loyalty schemes so that they understand their policy and operation.

In particular, consumers should be provided sufficient advanced notice of any changes to the policy or operation of the loyalty scheme, particularly in relation to approaching expiry of point balances to provide them an opportunity to redeem their accrued points.

Recommendation 2: Penalties for unfair contract terms and a prohibition against unfair trading practices

As it did in the Digital Platforms Inquiry, the ACCC has used this market study as a platform to advocate for the introduction of a prohibition against unfair trading practices and penalties for unfair contract terms.

The introduction of a prohibition against unfair trading practices may widen the scope of conduct caught by the consumer law and potentially create significant uncertainty for all businesses, not just loyalty schemes. It is unclear how the standard of “unfair” would be applied to particular conduct and the extent to which it would differ from the existing prohibitions against unconscionable conduct or unfair contract terms.

Recommendation 3: End the practice of automatically linking members’ payment cards to their loyalty scheme profile

The ACCC made a specific recommendation that the practice of linking members’ payment cards to their loyalty scheme profiles – so that their purchases can be tracked regardless of whether they scan their loyalty card – should end.

Notably, the ACCC indicated that its concerns about this practice could not be sufficiently addressed by disclosing the practice to consumers in the terms and conditions. The ACCC commented that consumers that decide to discontinue their use of loyalty schemes are unlikely to actively cancel their membership and ensure their card details are removed and no longer tracked.

Recommendation 4: Improve the data practices of loyalty schemes

In making this recommendation, the ACCC has specifically stated that loyalty schemes “need” to make their privacy and data polices less opaque and provide consumers with meaningful control over their data.

The action recommended by the ACCC includes providing consumers with clear information about the disclosure of their personal information to other sources, third party advertising and the use of their personal information for targeted advertising and providing consumers with meaningful opt-outs for these practices.

The ACCC also suggests that click-wrap agreements could potentially contain unfair contract terms and that privacy policies need to be brought in line with the Privacy Act 1988.

Recommendation 5: Strengthen protections in the Privacy Act and broader reform of the Australian Privacy Law

The ACCC reiterated its recommendations from the Digital Platforms Inquiry that the Privacy Act is strengthened, including by updating the definition of personal information, strengthening notification requirements for the collection of personal information, requiring consent when personal information is collected and erasing personal information when requested.

The potential for competition concerns – but no examples or recommendations

The ACCC outlined the potential for anti-competitive effects relating to loyalty schemes, but did not identify any particular instances where it thought such effects had occurred and did not make any competition related recommendations.

The potential anti-competitive effects identified by the ACCC focussed on the ‘lock up’ of customers and the difficulty that businesses without a loyalty scheme (or with a less successful loyalty scheme) would have competing for those customers. However, as noted, the ACCC did not identify any instances where these concerns were playing out in reality.

The ACCC also highlighted the collection and use of consumer data by loyalty schemes as raising the potential for competition concerns by increasing barriers to entry and expansion and allowing companies to retain their market power. The ACCC has said that this will be considered as part of merger decisions and competition assessments.

Implications for all businesses collecting and using personal information

The ACCC is increasingly looking to take enforcement action under the Australian Consumer Law in relation to data practices. While the loyalty schemes industry is on notice, this risk applies more broadly to any business collecting or using personal information.

The ACCC recently launched proceedings under the Australian Consumer Law against Google in relation to its collection and use of personal information. It has stated that it has another four competition and consumer law investigations into Google and Facebook on foot.

This type of action is not limited to the large digital platforms: the ACCC is also taking action against HealthEngine, an online health booking platform, for misusing user information, including by misleading users about how their personal information would be disclosed to other parties.

In light of these risks, all companies should consider how the ACCC’s recommendations in this market study, and in the Digital Platforms Inquiry, might apply to their business. Specifically, companies should review their terms and conditions and policies concerning personal information and consider whether they:

• raise unfair contract term concerns, particularly where key terms regarding the use of data or the benefits of giving that data are able to be unilaterally changed;
• are clear, accessible and readable – length and complexity should be minimised and the policy should be easy for consumers to find and navigate;
• adequately highlight the key aspects of how personal information is collected, used and disclosed;
• clearly disclose where personal information is shared and how advertising may be targeted; and
• contain definitions that are consistent with the Privacy Act

Businesses tracking credit card use should also heed the ACCC’s very strong view that such practices should be ceased.

With the Government due to respond to the ACCC’s recommendations in the Digital Platforms Inquiry report early next year, it is possible that businesses will be forced to address these issues irrespective of whether they independently decide to do so.