Google fined $60 million for misleading data practices

On 12 August 2022, the Federal Court ordered Google to pay $60 million in penalties for making misleading representations to consumers about the collection and use of their personal location data on Android phones, in contravention of the Australian Consumer Law (ACL).

This case highlights the serious legal consequences organisations can face if they are found to have misled consumers about how their data is being collected and used. It also demonstrates how consumer law can be used as an alternative to privacy law in protecting the personal information of individuals.

Background

In proceedings brought by the Australian Competition and Consumer Commission (ACCC) against Google LLC (Google) and Google Australia Pty Ltd (GAPL), the Federal Court initially found in April 2021 that certain practices engaged in by Google and GAPL had contravened sections of the ACL.

The Court held Google misled consumers about personal location data collected through their Android mobile devices between January 2017 and December 2018.

Subsequently, in August 2022, the Court handed down its finding on the appropriate penalties for these contraventions, ordering Google to pay $60 million. Notably, this was the amount that the ACCC and Google jointly submitted was an appropriate penalty.

Implications

This case is significant for a number of reasons.

Firstly, it is the ACCC's first public enforcement outcome arising from the ACCC's Digital Platforms Inquiry.

Secondly, it demonstrates how the ACL, with its substantial penalties, may be used as an alternative to privacy law in protecting individuals from improper collection and use of their data.

Thirdly, the Court order provides useful guidance on the compliance measures companies could adopt as part of their ACL compliance program, being:

• to have specific compliance policies in place addressing the ACL
• to provide regular (at least yearly) training on consumer laws relating to false, misleading or deceptive conduct; and
• to include awareness of the ACL as part of staff induction programs

Conclusion

Since 1 September 2018, new penalty provisions have been in place for contraventions of certain provisions of the ACL.

This case highlights that significant penalties may be awarded by the Court in contravention of the ACL under the new penalty provisions. Consequently, breaches of the ACL can no longer be seen by companies as a "cost of doing business".

Specific ACL compliance activities, in our view, will greatly assist in reducing a company's overall risk of potential contravention of the ACL and also the risk of investigation and/or enforcement action by the ACCC. Addressing this risk proactively is ultimately likely to be a more cost-effective measure than dealing with a regulatory audit or investigation, defending enforcement actions and then potentially paying a substantial penalty.

For advice and support regarding privacy, competition and consumer law requirements and best practice within your organisation, contact our experienced team of privacy, competition and consumer law experts.

Photo by Iliya Jokic on Unsplash.