Regulatory Update: What Marketers Need to Know

4th April, 2023

Strengthening Australia’s National Privacy Regulator

The Government will appoint a standalone Privacy Commissioner to deal with the growing threats to data security and the increasing volume and complexity of privacy issues.

Announced yesterday by Australia’s Attorney General, Mark Dreyfus, the appointment of the standalone Privacy Commissioner role will see the current Australian Information Commissioner, Ms Angeline Falk, retain the Information Commissioner and head of the OAIC role.

Why this matter to marketers:

Large scale data breaches in 2022 led to the government taking swift steps to significantly increase penalties for companies which fail to take adequate care of customer data. It also gave the Australian Information Commissioner improved and new powers.

This announcement is a significant move reflecting the government’s commitment to provide the privacy regulator with more resources and power to meet the ongoing challenges of the digital age and to ensure the personal information of all Australians is being properly protected.

With the regulators resourcing and powers being bolstered, businesses must ensure that they too strengthen their privacy practices and obligations.

Investing time and money into minimising your businesses risk in its collection, use, management of data (including personal information) is abetter use of your time and resources than incurring the high costs (actual and reputational) that data and/or privacy breach can bring to a business and its brands.

Privacy Awareness Week encourages businesses to go “back to basics”

Privacy Awareness Week (PAW) is an annual event to raise awareness of privacy issues and the importance of protecting personal information.

As we come to the end of Privacy Awareness Week 2023, we encourage all data-driven marketers to take this opportunity to ensure they are compliant and ready for the changes to come. For those wishing to invest in improving their understanding, the ADMA Marketing Compliance for Data Driven Marketers course provides insights into the existing framework, the privacy compliance status of your existing customer data and the complexities of gathering and using data.

Australia’s Privacy Regulator – OAIC also has ten “Privacy 101 for business” tips for reference:

1. Know your obligations

2. Have a Privacy Plan

3. Appoint a Privacy Champion

4. Assess your privacy risks

5. Implement Privacy by Design

6. Secure personal information

7. Simplify your privacy policy

8. Train Your staff

9. Prepare for Data Breaches

10. Review your Practices.

See here for more information from the OAIC.

ACCC social media report reinforcing the need for more protections for consumers and small business

Last week the ACCC released its 6th report in its Digital Platform Services Inquiry. As a key stakeholder, ADMA was invited to participate in the consultation on behalf of industry and engaged with ACCC on key issues.

This report examined competition between social media services in Australia and how consumers and businesses interact with social media services.

On release of the report, ACCC Chair Gina Cass-Gottlieb said, “social media services are an essential part of our daily lives and have provided many benefits to society. But we are concerned about the level of influence social media platforms hold over users and their position as critical intermediaries for businesses to reach customers. Limited competition in these services can lead to poorer outcomes for consumers and small businesses.”

“This report reinforces the need for reform, including specific mandatory processes for consumers and businesses to report and social media platforms to remove scams, harmful apps and fake reviews, and establishing an external Digital Ombuds Scheme.”

Why this matter to marketers:

Australian businesses rely on social media platforms to advertise their products/ services and to engage with consumers. Small and medium businesses are increasingly reliant on platforms like Facebook and Instagram for targeted, easy to use and cost-effective advertising solutions.

The report highlights the growth of the influencer marketing industry and raises concerns about inadequate disclosure of sponsored posts by influencers and brands.

Despite the ACCC identifying TikTok, Snapchat and Twitter as Meta’s closest competitors, it further reports that Australians continue to spend more time on Meta-owned Facebook and Instagram combined than any other social media platform, therefore Meta’s services have the most Australian users and advertisers. The ACCC contends that Meta’s competitors are not a significant constraint because there is differentiation between platforms. While younger Australians are more likely to use multiple social media services, older Australians use fewer platforms and still rely heavily on Facebook and Instagram.

The ACCC considers that a lack of effective competition in the supply of social media services can reduce innovation and consumer choice. Where there are a few (or no) comparable alternatives available, or consumers feel compelled to use the service because their social or work networks are on them, then users are more likely to accept conditions they otherwise would reject if there was greater choice.

Undesirable ‘take it or leave it’ terms can involve the unwanted collection and use of consumers’ data, particularly where there is no privacy law safety net or greater exposure to targeted advertising. Effective competition, in combination with effective regulation of privacy and data collection, may improve the level and range of privacy and data protection offered by social media platforms.

This report makes recommendations to address concerns around the lack of effective dispute resolution mechanisms, fake ratings and reviews and unfair trading practices and the issues that are emerging with the growth of influencer marketing (including uneven renumeration, online harassment and child influencers). The recommended measures include in particular the economy-wide prohibition against unfair trading practices, mandatory processes to prevent and remove scams, internal dispute resolution standards and access to an independent external Digital Ombuds Scheme, and additional competition measures with targeted competition obligations.

With the majority of Australian marketers using one or more social platforms, we encourage marketers to follow how this space develops and the implications for social media campaigns.

International update

TikTok fine

Last month, the UK Information Commissioners Office (ICO) issued a £12.7 million fine to TikTok for using children’s data without parental consent and not being clear with people (including children) about how their data is used.

The investigation found that:

a) TikTok had processed the data of children under the age of 13 without appropriate parental consent;

b) had failed to provide proper information to its users in a transparent way; and

c) processed special category data without legal grounds to do so.

The UK Information Commissioner John Edwards said;

“TikTok should have done better. Our £12.7 million fine reflects the serious impact their failures may have had. They did not do enough to check who was using their platform of take sufficient action to remove the underage children that were using their platform”

The fine is one of the largest issued by ICO.

Why this matters to Australian marketers:

This is one of the first major ICO fines focusing on transparency and misuse of children’s data. An aggravating factor in the decision appears to be that TikTok ought to have known about the level of use by under 13s and took no proactive steps to remove or prevent access to underage users. The decision is a warning shot to all social media platforms in terms of both transparency and children’s data. This follows the ICO clearly stating its objectives to prioritise children’s safety in the digital world. Businesses that provide online services that are more likely to be accessed by children need to be aware of more stringent regulatory requirements. In Australia the Review of the Privacy Act has also prioritised protection of privacy harms to children.

Chat GPT and Artificial Intelligence

Chat GPT, an AI chatbot that uses natural language processing to create humanlike conversational dialogue was launched in November 2022 by Open AI. By January 2023 ChatGPT reached 100 million active users making it the fastest-growing consumer application of all time. Interest in the application has been universal due to its ability to provide answers to questions and assist with tasks such as writing emails, essays, speeches and codes. While the privacy risks are still being discussed by policy makers and stakeholders, privacy regulators around the world have started to investigate Open AI and how personal data is being handled.

An open letter signed by numerous AI experts (such as Elon Musk and Apple co-founder Steve Wozniak) warned of potential risks of AI and ChatGPTs fast growth, calling upon AI developers to work with policymakers to develop a robust AI governance system. Note this letter saw pushback from other AI leaders including Bill Gates.

At the same time regulators around the world are taking different approaches to AI regulation. Italy banned and then resumed access to Chat GPT once Open AI met the conditions set by the local data protection authority (DPA) - including having users confirm they are 18+ or 13+ with consent from a parent or guardian etc, highlighting to users OpenAI’s Privacy Policy and links to articles from the company on how it “develops and trains Chat GPT”.

Similarly Germany and Canada are also investigating the manner in which OpenAI collects, uses and gives required notice with regard to personal information.

The UK government has also published a white paper on its “pro-innovation approach to AI regulation” and launched a public consultation calling for response.

Why this matters to Australian marketers:

As Australia looks to develop its own regulations around the use of AI, the learnings and insights from investigations in other jurisdictions will play a part in that process. The way in which AI is used to serve advertising and content (and the way in which personal information is used to do this) will impact data-driven marketers.