As data breaches and creepily specific scams become routine, our focus has continued to be on points of failure — hackers uploading a dataset, or an unwitting consumer clicking on a dodgy link.
The firms who make merry off trading in our sensitive information largely fly under the radar. The Australian Competition and Consumer Commission (ACCC)’s new, assertive report into “data firms” has taken a necessary step at probing the infamous “Wild West” of data capture and trading.
Some sobering examples of tradable consumer data revealed in the report include:
- ethnicity
- employment status
- living arrangements (with an emphasis on living alone)
- indicators of financial stress, distress or “un-savviness”
- indicators of gambling frequency (weekly, monthly or quarterly)
- indicators of a low education level
- indicators of “new migrant” status
- indicators of experiencing regular pain, or data revealing regular visits to certain medical facilities.
These are extreme examples of what is benignly described as “data collection and use”, and just a taste of the capabilities of a notorious, under-regulated sector. It should sound a clear alarm that the trade in personal information has gone too far.
Digital platforms and their regrettably codependent businesses have brought significant, tangible risks to Australians, ranging from scams, to data breaches, to distorted information. Managing these appropriately requires a uniquely coordinated policy response. Yet efforts at digital regulation have a habit of following the problems and regulating the “user” rather than managing the risks and regulating the firm.
The ACCC’s report provides extensive evidence and analysis of a wide array of data-fuelled business practices and leads to a compelling conclusion: Australia needs to toughen up its privacy laws, and the traditionally separate areas of privacy and consumer protection need to work closely together.
Back in 2019, the ACCC envisaged digital platform regulation as a comprehensive exercise that needed consumer protection, competition and data protection and privacy levers to all work together.
This is easier said than done: absent a comprehensive model, Australia’s digital platform regulation approach has splintered into discrete issues, with separate policy frameworks devised on an issue-by-issue basis (e.g. emerging mandatory industry codes on scams, voluntary industry codes on misinformation and disinformation, industry codes on online safety, emerging “responsible AI” frameworks, and a “strategy” on cybersecurity.
The notion of robust digital platform regulation may be back. The ACCC has sent a strong signal to the government that a) privacy reforms are urgent and must be as muscular as possible to protect Australians from harmful business practices, and b) privacy won’t be able to do it on its own.
Concurrent to the ACCC report, the privacy commissioner this week issued a plea for privacy reform, noting that the privacy regulator, the Office of the Australian Information Commissioner, will not continue its inquiries into TikTok’s tracking pixel, as it does not breach Australia’s present, demonstrably weak privacy obligations.
The ACCC has recently shifted its language from “data brokers” to “data firms”, defining them as offering “data collection, storage, supply, processing and analysis services”. This could be interpreted as a considered response to industry objections in the report’s submissions to the data broker label — the argument being they didn’t trade in information. Perhaps, with one eyebrow ever so gently raised, the ACCC pursued rebranding “brokers” to “firms” and widened the definitional scope, meaning that many more companies are eligible to be “data firms”.
Prima facie, trading in data is no sin — it is routine activity these days for businesses of all sizes. Indeed, monetising and marketising digital information is a “pivot” many, if not all, modern media organisations have taken to stay alive throughout successive digital “disruptions” to their business models. These shifts and insatiable market dynamics create an oft-unacknowledged tension between the noble cause of reliable online information and the right to browse the internet without relentless commodification.
The extreme end of what this dynamic has produced is addressed in the ACCC’s data firms report and contained in the list above. A section on vulnerable consumers, citing research from this writer’s employer, notes the intricate — and some would say predatory — ways data firms identify and target Australians for commercial gain.
The lure of the digital advertising business has incentivised the creation of diverse, detailed (and in some cases identifiable) data on consumers. This data is drawn from a range of sources and, in most cases, as the ACCC acknowledges, without consumers existing in a recognised relationship with the data firm that profiles them.
Digital advertising’s spin is that the invasiveness of the modern targeting machine is necessary for the delivery of timely and “relevant” online material. Yet few would agree that the categories outlined above would be in any way helpful for directing the flow of “relevant” digital advertisements. Nor has any person subjected to data-driven extraction, profiling or commodification had any meaningful opportunity to consent to or contest an omnipresent practice that sits behind anything from powering online newsfeeds to (indirectly) enabling personalised scams.
The ACCC leaves open what needs to happen next, placing hope in the coordinating potential with the other digital regulators of the eSafety Commissioner, the OAIC and the ACMA. The softly spoken part of the report is perhaps the most powerful: that no single regulator can solve the challenges of an upended and uniquely powerful data market, and none of them presently can even touch the sides of it.
Government is truly in an unenviable position — the mission of wrestling global data extraction behemoths into some semblance of future-proofed compliance commands imagery of genies escaping bottles. But a hard-nosed, market-focused regulatory effect is the only tool with half a chance to stop the clock on decades of data-powered thuggery.
