Federal proceedings against online health booking platform HealthEngine have brought attention to the complicated practice of bundled consent.
Federal proceedings against online health booking platform HealthEngine have brought attention to the complicated practice of bundled consent.
The first was an asymmetry of information, meaning customers were often presented with complex and ambiguous contracts they could not reasonably be asked to understand.
The second was an imbalance in bargaining power, where online platforms sought sweeping consent from users to collect, use and disclose personal data without providing a chance to fully engage with the terms and conditions.
In contract law, this is referred to as ‘forced’ or ‘bundled’ consent, a situation where consent is sought only once because the number of clauses is so numerous it would be impractical to agree to each individually.
The practice of bundled consent has become increasingly common in online contracts, where customers provide consent to highly technical legal documents, unaware of what it is they may have agreed to.
Tech giants have been criticised for asking for bundled consent in the past, with France’s CNIL fining Google €50 million ($A82 million) earlier this year for not seeking valid consent under EU law.
Following its July report, the ACCC drew attention to bundled consent earlier this month when it instituted federal proceedings against Western Australia-based HealthEngine.
In its filing, the ACCC had alleged that the platform, which facilitates listings for more than 70,000 health practices and practitioners in Australia, had sold the personal information of more than 135,000 patients without their knowledge and manipulated 3,000 reviews published to its site.
While HealthEngine founder Marcus Tan had previously said the platform was not meant to operate as a traditional rating and review site, the ACCC provided samples of customer reviews that had been edited to misrepresent negative comments about practices’ accessibility, billing practices and wait times.
In doing so, the ACCC alleged that HealthEngine failed to disclose important information to consumers, which meant patients might have chosen a healthcare provider they otherwise may have avoided, and created a false impression about the quality of health practices accessible through the site.
As a remedy, the ACCC cited recommendations made in its ‘Digital Platforms Inquiry Report’ to strengthen consent and notification requirements under the Privacy Act.
Among the recommendations made were an update to the definition of personal information in online contracts, stronger notification requirements for the collection of personal data, and ‘opt-in’ consent requirements for online contracts.
In the ACCC’s statement at the time, chair Rod Sims made specific reference to stopping the practice of bundled consent as a part of an effort to enforce greater clarity from businesses about how customer data will be used.
“Issues of transparency and adequate disclosure when digital platforms collect and use consumer data is one of the top priorities at the ACCC,” Mr Sims said.
“Businesses who are not upfront with how they will use consumer data may risk breaching the Australian Consumer Law and face action from the ACCC.
“One of our recommendations from the Digital Platforms Inquiry is that obtaining consent for different purposes of data collection, use or disclosure must not be bundled.”
While the ACCC’s argument against bundled consent highlighted the importance of consumer privacy and consent, there is a case to be made against invalidating consent retroactively.
The University of Western Australia’s Sagi Peari told Business News there was a growing tendency worldwide to question the validity of terms in online contracts.
A lecturer and researcher on topics of commercial, private and international law, Dr Peari said a notable example of this was ‘Douez v Facebook, Inc’, a decision made by the Supreme Court of Canada two years ago that established the privacy rights of consumers as superseding the terms of Facebook’s user agreement.
Though Dr Peari said that decision was specific in scope and restricted to a specific argument of Canadian constitutional law, he also cited the ACCC’s 2014 case against international gaming company Valve Corporation, where Australian Consumer Law was found to retroactively apply to the company’s own stated refund policy.
“In the future, the courts might actually invalidate consent,” Dr Peari said.
“For instance, businesses will place certain terms and conditions into a contract, and afterwards, the courts will say they’re not valid.”
Expressing concern about the precedent of invalidating consent after it has been given, Dr Peari said he could not say definitively whether he supported proceedings against HealthEngine if its contract stated it could sell information to third parties.
“It depends how clearly it’s stated on the website, [and] whether a reasonable consumer could see them,” he said.
“If the answer is yes, based on common law tradition … I would consider carefully whether we want to invalidate terms and conditions in the contract.”
Although Dr Peari said the internet had complicated ordinary contractual relationships, he said unfavourable contractual terms and weak negotiations were not unique to the online space, and that laws already existed to protect consumers against unfair contract terms.
Further, he was wary of courts overruling contracts, saying businesses would struggle with certainty if that were to become commonplace.
Dr Peari suggested an alternative approach to regulation that was balanced for both parties, respecting the certainty a contract provides once it is signed.
“We must say clearly to businesses that you are allowed to place terms and conditions in a contract and the courts will honour and respect them, but be aware that certain things must be clarified to consumers,” he said.
“Everything related to rights, like termination, damages and jurisdiction must attract the attention of consumers, placed in bold and clear language.
“Then I would require another signature from consumers … certain things that are more important should ask for a consumer to write in their own words they agree
“You shouldn’t have to be a lawyer [to read a contract], but you should be careful enough.”
