Unlike in a number of countries, including Australia, New Zealand is yet to see any case law and regulatory action from the Commerce Commission that provides guidance on when "informing" consumers about changes to privacy policies is misleading.
This decision provides guidance for New Zealand businesses when amending privacy policies and notifying individuals given the similarities between Australia's and New Zealand's consumer and privacy laws.
What was the case about?
From June 2016 to December 2018, Google sought the permission of its account holders to make changes to the settings in their Google Accounts which, if agreed to, enabled and authorised Google to:
combine account holders' personal information with their browsing activity on third party websites and apps;
allow that combined information to be used to create or generate targeted advertising for third party websites and apps which partnered with Google (as well as Google's various websites and apps); and
deliver targeted advertising to account holders on any device which they were signed into their Google account on.
In order to obtain consent to make these changes, Google displayed a notification to account holders on their desktop and mobile devices (Notification). The Notification introduced these changes as optional features to give users more control over Google's collection and use of their data. In particular, the main page of the Notification:
stated that new features would be available to the account holder, such as more information being available on their Google account for their review and control;
that the available information might include browsing data from third party websites and apps which partner which Google;
that Google would use this information to generate more relevant advertisements across all of the user's signed-in devices;
that, as before the changes, Google would not sell users' personal information, and users retained control over the information that Google could collect from them; and
prompted account holders to either consent to the changes by clicking an "I agree" button at the bottom of the main page, or clicking "More Options" or "Learn More" buttons if account holders wanted more information or wished to reject the changes.
How did the Court approach the interpretation of misleading and deceptive conduct?
The Court first considered whether Google had engaged in conduct that was misleading or deceptive by omitting information from the Notification.
Both parties called expert evidence on the structure and content of the Notification, and its effect on users. The ACCC's expert evidence was heavily based on the application of behavioural science principles to account holders' interaction with and understanding of the Notification. For example, the ACCC's expert stated that account holders would likely:
not have noticed and/or clicked the link on the first page of the Notification which provided further information;
have had "limited time" and "limited willingness" to read the Notification fully, and that "many (if not most) users only read the headings"; and
have been biased towards agreeing to the proposed change in the Notification.
The ACCC's expert advanced that, through the structure and content of the Notification, Google manipulated and misled account holders into accepting changes that they did not understand and concealed the fact that those changes affected their privacy.
The Court was highly critical of this analysis, describing the ACCC's expert's conclusions as "hypotheses, conjecture, or predictions" formulated "without reference to data". On this point, the Court specifically noted that the ACCC provided no evidence of consumers being misled (despite there being clear case law that such evidence is not strictly required – which has long been established in New Zealand under the Fair Trading Act).
Interestingly, the Court found that that both parties' expert evidence was of "limited assistance" overall, with Yates J commenting that he was able to read and form his own views regarding the Notification. Yates J noted that the ACCC's expert evidence would have been more helpful and persuasive if it had been supported by empirical analysis.
This treatment of the expert evidence suggests at least some courts are likely to take an uncomplicated approach to the interpretation of alleged misleading or deceptive representations. His Honour focused on the plain language and its meaning as understood by consumers as opposed to the abstract arguments about what consumers may have subjectively understood.
In considering the Notification on these terms, Yates J found that it did not constitute misleading or deceptive conduct by omission, holding that:
if the first page of the Notification was misleading or deceptive due to the omission of information by Google, Google's conduct would have been misleading or deceptive regardless of whether account holders could read other pages of the Notification which would correct misconceptions created on the first page – this is an important reminder for businesses who seek to qualify or correct information on separate webpages; and
the conduct must be evaluated on the basis that account holders did in fact read the first page of the Notification. The Court noted that users who did not take the time to read that page would not have been acting reasonably in their own interests.
Implications for New Zealand businesses in the privacy space
The Court's analysis of the Notification and Google's conduct provides helpful guidance for what is required from businesses when obtaining consent from individuals in relation to the collection and use of personal information. Given the Notification was not misleading or deceptive, Google would have had reasonable grounds to believe that it had gained consent from its account holders to change the way those account holders' personal information was collected and used.
This article is intended only to provide a summary of the subject covered. It does not purport to be comprehensive or to provide legal advice. No person should act in reliance on any statement contained in this publication without first obtaining specific professional advice. If you require any advice or further information on the subject matter of this newsletter, please contact the partner/solicitor in the firm who normally advises you, or alternatively contact one of the partners listed below.