An increase in personal data collection has led to concerns de-identified information could be traced back to an individual as datasets are combined.
A new report from the Australian Competition & Consumer Commission (ACCC) found that consumers were generally unaware how much of their data was collected, used and shared with data firms and other businesses.
ACCC Deputy Chair Catriona Lowe said as consumers were increasingly required to provide personal information to access services, there was a concern they may be unable to control how their data was shared and used.
“While data firms’ products and services often use de-identified data, the ACCC is concerned about the growing risk of consumers being re-identified as datasets are combined with additional data points,” Ms Lowe said.
“The report also highlights the potential identification and targeting of vulnerable consumers when consumers are categorised into groups to enable businesses to identify potential customers.
“For example, a consumer segment that identifies people as ‘frequent gamblers’ may be used to advertise gambling products to people who have a gambling addiction,” Ms Lowe said.
She said the Digital Platform Services Inquiry report shone a light on a relatively unknown part of the data ecosystem and examined the data products and services supplied by data firms.
“In many cases, the data firms do not have a direct relationship with the consumers whose data may be used,” Ms Lowe said.
Data firms collect consumer data from a range of online and offline sources and use it to create and sell data services to business customers across many industries for a variety of purposes.
These services include data-driven marketing and advertising, risk management, such as identity verification and fraud detection services, and property data and analytics services.
Ms Lowe said long and complex privacy policies that use ambiguous language or ‘take-it-or-leave-it’ terms make it difficult for consumers to understand, intentionally consent to and control what happens to their data.
“The report observes that data collection practices do not align with consumer expectations, based on a 2023 consumer study which found that 74 percent of Australians are uncomfortable with their personal information being shared with or sold to other companies.
“Many consumers may be unaware of the scope of data that is collected and then shared or on-sold to other data firms or unidentified third parties,” Ms Lowe said.
She said the report underlined the need for new service-specific mandatory codes of conduct for particular “designated digital platforms”.
