The decision, issued last week, offers a significant example of privacy contraventions being pursued through the ordinary mechanisms of consumer law, on the basis that data collection settings can be “misleading or deceptive" if not properly explained to the customer.
The case will be of interest to consumer-facing businesses in New Zealand, given the similarity of the two countries' consumer protection laws and the increasing focus on data collection practices. It may also increase the likelihood of similar claims by the Commerce Commission, which has previously commented on the growing intersection between consumer and privacy law.
Summary of the case
Background
The proceeding concerned information presented to users of Android devices about privacy settings on those devices. The claim focussed on two particular settings: “Web & App Activity" and “Location History." These were accessible during the sign-up process on a screen titled “Privacy and Terms," under a drop-down menu titled “More Options."
The default settings showed Web & App Activity as “on", and Location History as “off". However, even though Location History was set to “off", Google could nevertheless obtain location data from customers via various Google apps (provided the “Web & App Activity" setting was set to “on").
The ACCC's central claim was that these default settings were likely to mislead customers into thinking that Google could not obtain personal data about their location, and that customers would naturally assume that turning off “Location History" would prevent access to their location data. Because this was the default setting for Android devices, users who wished to keep their location data private would have assumed that no further steps were needed.
The ACCC relied on various documents which it claimed showed that Google was aware that the information provided to users was confusing. These included an internal communication describing the interface as “crazy confusing", and another which stated that it “seems like we are not very good at explaining this to users."
In response, Google submitted that other information was available on the Privacy and Terms screen which explained that location data could be collected via Google apps, and that there was a link on that page to Google's privacy policy which also made the position clear. Google emphasised that customers were required to click on a button at the foot of the page which stated “I agree."
Decision
The Judge found that the presentation of the relevant settings was misleading. In rejecting Google's careful arguments about the information that was available to customers, the Judge observed that: “Google's arguments have more and more attraction the longer one pores over the various screens and analyses their content. This is not the appropriate approach."
Rather, the Judge held that it was necessary to adopt the position of “a reasonable user setting up his or her device, sufficiently interested to click on “More Options", but not necessarily meticulous." On that basis, the Judge concluded that there were reasonable users among that class who would have incorrectly assumed that Google would not obtain personal location data while the Location History setting was “off".
The Judge also examined other aspects of the customer journey which had been challenged by the ACCC. In certain scenarios the Judge dismissed the ACCC's allegations (e.g. where customers “paused" Location History, additional explanation was provided to customers regarding collection of location data through Google services). However, the ACCC's primary claim was successful. The ACCC is seeking various remedies (including pecuniary penalties and corrective publication orders) which will be determined at a later date.
Relevant class
The judgment contains an interesting discussion about how to identify the relevant “class" of consumers in cases of this nature. Google had submitted that the correct approach was to judge the conduct by reference to “a single hypothetical user having only one possible reaction." The Judge rejected this approach, saying that it would “naturally invite consideration of the response of the majority" such that unless the majority were misled, cases would fail even where reasonable consumers had been misled. The Judge held that, provided the conduct misled “some reasonable users", that was sufficient, and that: “the number or proportion of reasonable users who were misled does not matter for the purposes of establishing contraventions."
The adoption of this test creates particular risk in the context of digital platforms, given that it may often be possible for a Judge to conclude that some reasonable consumers may be misled by some specific aspect of their account settings or the relevant sign-up process, even where others (the majority, even) do understand the position accurately.
Implications
Google has announced that it is considering appealing the decision. It is also separately defending two other disputes with the ACCC – an allegation of misuse of market power, and a separate proceeding regarding use of data from non-Google sites.
For now at least, the Federal Court's decision raises significant implications for any businesses with consumer-facing digital platforms. Among other things, it is striking that the Judge gave very little weight to the fact that customers had confirmed “I agree" to the privacy terms, appearing to set aside the possible contractual effect of that step on the basis that customers “would have scrolled relatively quickly through the Privacy and Terms screen." That approach will be disquieting for the many businesses who rely on similar mechanisms (e.g. checkboxes confirming agreement to terms) and appears to cut against the traditional starting point that express assent binds a customer regardless of whether they have read the terms.
The judgment also heightens the importance of clearly explaining how data is collected. As the judgment shows, deficiencies now face more complex consequences. They might once have been treated as solely a privacy issue, but now could potentially be challenged as misleading or deceptive conduct under fair trading legislation.
The Fair Trading Act (which contains essentially identical provisions to those at issue in ACCC v Google) is regulated actively by the Commerce Commission, which has increasingly commented on the need to ensure that websites are accurate and not misleading. In light of this growing scrutiny, and the Federal Court's judgment, consumer-facing businesses in New Zealand may wish to review their digital platforms carefully, to ensure that customers' rights are articulated as clearly as possible.
If you have any questions about the matters raised in this article, please get in touch with the contacts listed or your usual Bell Gully advisor.
Disclaimer
This publication is necessarily brief and general in nature. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.