Australian Competition and Consumer Commission v Equifax Australia Information Services and Solutions Pty Ltd

National Practice Area: Commercial and Corporations

Sub-area: Regulator and Consumer Protection

Counsel for the Applicant: Mr M Darke SC with Mr J Clark

Solicitor for the Applicant: Norton Rose Fulbright Australia

Counsel for the Respondent: Mr C Moore SC with Ms F Gordon and Ms G Keesing

BETWEEN: AUSTRALIAN COMPETITION AND CONSUMER COMMISSION Applicant

AND: EQUIFAX AUSTRALIA INFORMATION SERVICES AND SOLUTIONS PTY LTD ACN 000 602 862 Respondent

JUDGE: LEE J DATE OF ORDER: 27 SEPTEMBER 2018

NOTICE TO: EQUIFAX AUSTRALIA INFORMATION SERVICES AND SOLUTIONS PTY LTD (ACN 000 602 862) IF YOU (BEING THE PERSON BOUND BY THIS ORDER): A. REFUSE OR NEGLECT TO DO ANY ACT WITHIN THE TIME SPECIFIED IN THIS ORDER FOR THE DOING OF THE ACT; OR B. DISOBEY THIS ORDER BY DOING AN ACT WHICH THE ORDER REQUIRES YOU NOT TO DO, YOU WILL BE LIABLE TO IMPRISONMENT, SEQUESTRATION OF PROPERTY OR OTHER PUNISHMENT. ANY OTHER PERSON WHO KNOWS OF THIS ORDER AND DOES ANYTHING WHICH HELPS OR PERMITS YOU TO BREACH THE TERMS OF THIS ORDER MAY BE SIMILARLY PUNISHED.

THE COURT DECLARES THAT:

1. From 5 July 2016 to 3 March 2017, Equifax Australia Information Services and Solutions Pty Ltd (Equifax), in trade or commerce: (a) engaged in conduct that was misleading or deceptive, or likely to mislead or deceive, in contravention of section 18 of the Australian Consumer Law (ACL), being Schedule 2 to the Competition and Consumer Act 2010 (Cth) (CCA); (b) in connexion with the supply, the possible supply, or the promotion of the supply or use of its fee-based credit reporting services to consumers, made false or misleading representations with respect to the uses or benefits of such services in contravention of section 29(1)(g) of the ACL; and (c) in connexion with the supply, the possible supply or the promotion of the supply of its fee-based credit reporting services to consumers, made false or misleading representations concerning the need for such services in contravention of section 29(1)(l) of the ACL, by representing to consumers from time to time during telephone calls that the Equifax credit score which consumers received as part of its services was the same credit score as that which credit providers used to assess credit applications, extensions of credit or the terms upon which credit would be provided to consumers (Lender Credit Score Representation), when in fact: (d) some credit providers did not use the Equifax credit score in assessing some or all of the following: (1) credit applications or extensions of credit; or (2) the terms upon which credit would be provided; (e) other credit providers used the Equifax score only in limited circumstances; and (f) the Equifax credit score provided to a credit provider may have been different from the credit score provided to a consumer who purchased the service with the Equifax credit score.
2. From 7 July 2016 to 3 March 2017, Equifax, in trade or commerce: (a) engaged in conduct that was misleading or deceptive, or likely to mislead or deceive, in contravention of section 18 of the ACL; and (b) in connexion with the supply, the possible supply, or the promotion of the supply or use of its fee-based credit reporting services to consumers, made false or misleading representations with respect to the uses or benefits of such services in contravention of section 29(1)(g) of the ACL; and (c) in connexion with the supply, the possible supply or the promotion of the supply of its fee-based credit reporting services to consumers, made false or misleading representations concerning the need for such services in contravention of section 29(1)(l) of the ACL, by representing to consumers from time to time during telephone calls that its credit report supplied as part of its fee-based service was more comprehensive than its free credit report (Paid Credit Report Representation) when in fact they contained the same information.
3. From 1 February 2016 to 3 March 2017, Equifax, in trade or commerce: (a) engaged in conduct that was misleading or deceptive, or likely to mislead or deceive, in contravention of section 18 of the ACL; and (b) in connexion with the supply, the possible supply or the promotion of the supply of its fee-based credit reporting services to consumers, made false or misleading representations with respect to the price of such services in contravention of section 29(1)(i) of the ACL, by, from time to time: (c) representing to consumers during telephone calls that they would be charged a single 'one-off' or 'one-time' payment for the services; and/or (d) failing to disclose to consumers during telephone calls that the services were automatically renewed unless the consumer opted out, (One-Off Payment Representation), which was false, misleading or deceptive because the services were automatically renewed, and the consumer was charged, for further successive 12 month periods unless the consumer opted out.
4. From October 2016 to October 2017, in trade or commerce and in connexion with the supply of its fee-based credit reporting services to a consumer with the initials TL, Equifax engaged in conduct that was, in all the circumstances, unconscionable in contravention of section 21 of the ACL as follows: (a) TL phoned Equifax, explained that she thought she was the victim of a "phishing scheme" and asked for advice as to what she should do; (b) Equifax told TL that she needed to purchase a copy of her credit report; (c) Equifax did not advise TL that it provided credit reports for free; (d) Equifax made the One-Off Payment Representation to TL; (e) in reliance upon Equifax's advice, TL purchased a fee-based credit reporting service; (f) Equifax told TL that it was a public organisation; and (g) Equifax refused to refund TL.
5. In August 2017, in trade or commerce and in connexion with the possible supply of its fee-based credit reporting services to a consumer with the initials MC, Equifax engaged in conduct that was, in all the circumstances, unconscionable in contravention of section 21 of the ACL as follows: (a) MC was a single mother, had once been declared bankrupt, was on a low income, and was seeing a financial counsellor; (b) following MC's application for a free credit report, Equifax phoned her to try to sell her a fee-based credit reporting service; (c) MC explained to Equifax that she had sought the help of a financial advisor in dealing with some debts, and that applying for her credit report was one of the steps they had taken. MC explained that paying off her debts was her "priority"; (d) Equifax made the Lender Credit Score Representation to MC; (e) Equifax told MC that it would take 10 days for the free report to be provided and that the price was only available for a limited time; (f) although MC advised that she did not have enough money and her financial counsellor told Equifax to cease calling MC, Equifax phoned MC at least 7 more times over the next week leading to her feeling harassed; and (g) during one of the calls, Equifax told MC that with a paid package she would have access to credit correction services and that if she performed a credit check on herself it would leave a "mark" on her file and "damage" her score.
6. In or around August 2016, in trade or commerce and in connexion with the supply of its fee-based credit reporting services to a consumer with the initials OR, Equifax engaged in conduct that was, in all the circumstances, unconscionable in contravention of section 21 of the ACL as follows: (a) following OR's application for a free credit report, Equifax phoned her to try to sell her a fee-based credit reporting service; (b) OR did not understand what Equifax told her on the call because she had a limited understanding of English and this should have been apparent to Equifax from OR's responses. OR also informed Equifax that she had lost her job; (c) Equifax made the Lender Credit Score Representation and One-Off Payment Representation to OR; (d) Equifax processed payment for its fee-based service on OR's credit card without her realising that it was doing so; and (e) Equifax refused to refund OR, notwithstanding that over the following 24 hours she and her husband called Equifax a number of times to explain that a mistake had been made, and OR did not want the paid package she had been charged for. THE COURT ORDERS THAT:
7. Equifax be restrained for a period of 5 years from the date of this Order, whether by itself, its servants, its agents or otherwise, from engaging in misleading or deceptive conduct of the type described, or making any of the false or misleading representations referred to, in paragraphs 1 to 3 above, or engaging in conduct of the type referred to in paragraphs 4 to 6 above, while selling, marketing or promoting its fee-based credit reporting services to consumers.
8. Within 30 days of the date of this Order, Equifax pay to the Commonwealth of Australia a pecuniary penalty of $3.5 million in respect of the contraventions of the ACL referred to in the declarations in paragraphs 1 to 6 above, comprised as follows: (a) $750,000 in respect of the contraventions of sections 29(1)(g) and 29(1)(l) of the ACL that are the subject of the declaration in paragraph 1 above (the Lender Credit Score Representation); (b) $500,000 in respect of the contraventions of sections 29(1)(g) and 29(1)(l) of the ACL that are the subject of the declaration in paragraph 2 above (the Paid Credit Report Representation); (c) $750,000 in respect of the contraventions of section 29(1)(i) of the ACL that are the subject of the declaration in paragraph 3 above (the One-Off Payment Representation); (d) $500,000 in respect of the contravention of section 21 of the ACL that is the subject of the declaration in paragraph 4 above (the unconscionable conduct in relation to customer TL); (e) $500,000 in respect of the contravention of section 21 of the ACL that is the subject of the declaration in paragraph 5 above (the unconscionable conduct in relation to customer MC); and (f) $500,000 in respect of the contravention of section 21 of the ACL that is the subject of the declaration in paragraph 6 above (the unconscionable conduct in relation to customer OR).
9. Equifax publish, or cause to be published, at its own expense, within 14 days of this order, a colour copy of a corrective notice in the form and in terms set out in Annexure A (Corrective Notice) in the proceeding on both the Equifax Website and MyCreditFile Website, and further, to ensure that such corrective notice is: (a) located on its own dedicated webpage (Corrective Notice Webpage); (b) accessible via a link on the homepage of both the Equifax Website (located at the URL https://www.equifax.com.au) and MyCreditFile Website (located at the URL https://www.mycreditfile.com.au) (Click-through Link), which: (i) is viewable immediately (i.e. without the need to scroll down) on a computer screen or mobile device upon access to the homepage of each website; (ii) contains the words "AN IMPORTANT NOTICE FOR CONSUMERS - BREACHES OF THE AUSTRALIAN CONSUMER LAW BY EQUIFAX - ARE YOU ELIGIBLE FOR A REFUND?", which are to be in uppercase, 18 point, bold, black, sans serif font on a white background, centred and in a black bordered box; (iii) contains the words "Click here for further information", which are to be 14 point, black, sans serif font on a white background and centred below the words "AN IMPORTANT NOTICE FOR CONSUMERS - BREACHES OF THE AUSTRALIAN CONSUMER LAW BY EQUIFAX - ARE YOU ELIGIBLE FOR A REFUND?" in the same bordered box; (iv) is of a size that is at least 255 pixels wide by 60 pixels high; and (v) is maintained for a period of 90 days; (c) occupies the entire webpage that is accessible via the Click-through Link; (d) is not displayed as a 'pop up' or 'pop-under' window; (e) has a headline font of no less than 18 point, bold, black, sans serif font on a white background and centred; (f) has a body font of no less than 14 point, black, sans serif font on a white background; (g) crawlable (i.e. its contents may be indexed by a search engine); and (h) maintained on the Corrective Notice Webpage for a period of 90 days.
10. Equifax send an email (to the email address Equifax has on file), within 45 days of the date of publication of the Corrective Notice referred to in order 9 above, with the subject "IMPORTANT NOTICE - ARE YOU ELIGIBLE FOR A REFUND? BREACHES OF THE AUSTRALIAN CONSUMER LAW BY EQUIFAX", containing the Corrective Notice to each consumer who purchased a credit report as a standalone (non-subscription) product called My Credit File or as part of the My Credit Alert (formerly My Veda Alert), Equifax Basic (formerly Veda Starter), Equifax Plus (formerly Veda Access) Equifax Advanced (formerly Veda ID) or Equifax Premium (formerly Veda Plan) services (Paid Credit Report) from Equifax over the telephone during the period 1 February 2016 to 3 March 2017.
11. Equifax implement a consumer redress regime in accordance with the following process (Consumer Redress Process), which is to be made available for a period which is 180 days from the later of the date of publication of the Corrective Notice referred to in order 9 above, or the date on which Equifax sends by email the Corrective Notice to each affected consumer in accordance with order 10 above: (a) For each consumer who purchased a Paid Credit Report from Equifax over the telephone during the period 1 February 2016 to 3 March 2017 and contacts Equifax in relation to the matters set out in the Corrective Notice within the 180 day period referred to above (Eligible Purchaser), Equifax will provide a refund of the amount(s) paid by the Eligible Purchaser upon renewal of their Paid Credit Report subscription, within 14 days of Equifax finding, having regard to the call recordings, that an Equifax representative made the One-Off Payment Representation or otherwise misled them concerning the automatic renewal of the product, to the extent the amount(s) have not already been refunded. (b) For each consumer who purchased a Paid Credit Report from Equifax over the telephone during the period 7 July 2016 to 3 March 2017 and contacts Equifax in relation to the matters set out in the Corrective Notice within the 180 day period referred to above (also an Eligible Purchaser), Equifax will provide a full refund to the Eligible Purchaser, within 14 days of Equifax finding, having regard to the call recordings, that Equifax: (i) made the Paid Credit Report Representation or otherwise misled them regarding the content of a paid credit report compared to a free credit report; or (ii) made the Lender Credit Score Representation or otherwise misled them regarding the Equifax credit score, specifically that the credit score consumers received as part of the services was the same credit score as that which credit providers used in assessing credit applications, extensions of credit or the terms upon which credit would be provided to consumers, to the extent the amount(s) have not already been refunded. (c) Each Eligible Purchaser who requests a refund in accordance with paragraph 11(a) or (b) above and is denied redress by Equifax for a reason other than that the Eligible Purchaser has already received a refund from Equifax, will within 30 days have their request reviewed by the Independent Third Party appointed under order 12 below. If the Independent Third Party decides that an Eligibile Purchaser is entitled to a refund because of one or more of the matters set out in the Corrective Notice, Equifax will provide the refunds described in paragraphs 11(a)-(b) to that consumer within 14 days of the Independent Third Party's decision. (d) Equifax will provide the refunds described in sub-paragraphs (a), (b) and (c) by electronic funds transfer to a bank account nominated by the Eligible Purchaser. (e) Equifax will complete the Consumer Redress Process within 14 days of the later of the Consumer Redress Process ceasing to be made available to consumers as described in paragraph 11 above or the last decision made by the Independent Third Party pursuant to sub-paragraph (c) above.
12. The Court appoint Edward Cowpe of Level 22 Chambers, 52 Martin Place Sydney (Independent Third Party) to: (a) carry out the review of any cases of refund refusals referred to in paragraph 11(c) above; and (b) carry out a review of the Consumer Redress Process (Consumer Redress Process Review) and provide within 60 days of the conclusion of the provision of refunds under the Consumer Redress Process specified in paragraphs 11(a)-(d) above a report to the Court, Equifax and (on a confidential basis save for the purposes of making an application pursuant to order 16 below) the ACCC, which will provide particular and specific information regarding the scope of the Consumer Redress Process Review and, at a minimum, report on the following: (i) the number of consumers who contacted Equifax through the Consumer Redress Process; (ii) the number of consumers who were given redress (including specifically identifying the number of consumers given redress pursuant to the review referred to in paragraph 11(c) above); (iii) the average number of days taken to provide that redress to consumers after contacting Equifax through the Consumer Redress Process; (iv) the number of consumers who were denied redress; and (v) reasons why any such consumers were denied redress.
13. Equifax must: (a) use its best endeavours to ensure that the Consumer Redress Process Review is conducted on the basis that the Independent Third Party has access to all relevant sources of information in Equifax's possession or control, including without limitation Equifax's records of the communications with customers who have responded to the Corrective Notice; and (b) pay the reasonable fees charged by the Independent Third Party in respect of the tasks referred to in paragraph 12.
14. Equifax, at its own expense, must: (a) within 14 days of the date of these orders and prior to the publication of the Corrective Notice: (i) provide for an email address, at which consumers who are responding to the Corrective Notice can contact Equifax; (ii) provide for a 1800 telephone number at which consumers who are responding to the Corrective Notice can contact Equifax; (iii) provide for a post office box at which consumers who are responding to the Corrective Notice can contact Equifax; and (iv) appoint a representative/representatives of Equifax (Contact Officer) to reply to any correspondence received by Equifax in response to the Corrective Notice; and (b) maintain the email address, telephone number, post office box and Contact Officer referred to in sub-paragraphs (a)(i) to (iv) above for a period of 180 days.
15. Within 30 days of the date of this Order, Equifax pay the amount of $100,000 to the Applicant in respect of the Applicant's costs of and incidental to the proceeding.
16. The parties have liberty to apply within 14 days of the receipt of the Independent Third Party's report referred to in paragraph 12(b) above.
17. If liberty to apply is to not exercised within that 14 days, then the proceeding is dismissed. Annexure A Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

A Introduction 1 This is a proceeding brought for the imposition of a pecuniary penalty by the Australian Competition and Consumer Commission (ACCC) and for associated relief. The respondent, Equifax Australia Information Services and Solutions Pty Ltd (Equifax) is wholly owned by Equifax Pty Limited, which owns a large group of entities offering credit reporting and other data and analytics services in Australia. 2 The ACCC alleges that Equifax engaged in conduct in contravention of ss 18, 21, 24(1), 29(1)(g), 29(1)(i), 29(1)(l) and 34 of the Australia Consumer Law (ACL). Equifax has admitted to contraventions of ss 18, 21, 29(1)(g), 29(1)(i) and 29(1)(l) of the ACL on the basis of agreed facts. I will come back to the agreed facts below. 3 As I outlined in Australian Competition and Consumer Commission v Pental Limited [2018] FCA 491 at [48], "the principal object of a pecuniary penalty is to attempt to put a price on a contravention that is sufficiently high to deter repetition by the contravener and by others who might be tempted to contravene". Given this, and the agreement that has been reached between the parties, the present circumstances call for consideration of essentially two matters: first, forming a view as to whether I am sufficiently persuaded of the accuracy of the parties' agreement as to the relevant facts and consequences; and, secondly, whether the penalties the parties propose are an appropriate remedy in all the circumstances. 4 The reason I put the matter this way is in recognition of the important public policy involved in promoting the predictability of outcomes and civil proceedings which, in turn, encourages corporations to acknowledge contraventions. Such acknowledgements, of course, assist in avoiding lengthy and complex litigation and hence diminish the demand on the public resources constituted by both the Court and the regulator. As the High Court explained in Commonwealth of Australia v Director, Fair Work Building Industry Inspectorate [2015] HCA 46; (2015) 258 CLR 482 at 507 [57]: …in civil proceedings there is generally very considerable scope for the parties to agree on the facts and upon consequences. There is also very considerable scope for them to agree upon the appropriate remedy and for the court to be persuaded that it is an appropriate remedy. Accordingly, settlements of civil proceedings are commonplace and orders by consent for the payment of damages and other relief are unremarkable. So are court-approved compromises of proceedings on behalf of infants and persons otherwise lacking capacity, court-approved custody and property settlements, court-approved compromises in group proceedings and court-approved schemes of arrangement. More generally, it is entirely consistent with the nature of civil proceedings for a court to make orders by consent and to approve a compromise of proceedings on terms proposed by the parties, provided the court is persuaded that what is proposed is appropriate. 5 More specifically, in relation to civil penalty proceedings, French CJ, Kiefel, Bell, Nettle and Gordon JJ (with whom Keane J agreed) observed at 507 [58]: Possibly, there are exceptions to the general rule. There is, however, no reason in principle or practice why civil penalty proceedings should be treated as an exception. Subject to the court being sufficiently persuaded of the accuracy of the parties' agreement as to facts and consequences, and that the penalty which the parties propose is an appropriate remedy in the circumstances thus revealed, it is consistent with principle and, for the reasons identified in Allied Mills, highly desirable in practice for the court to accept the parties' proposal and therefore impose the proposed penalty. To do so is no different in principle or practice from approving an infant's compromise, a custody or property compromise, a group proceeding settlement or a scheme of arrangement. (citations omitted) 6 In addressing these issues and determining relief, I will divide the remainder of these reasons into the following sections: B Relevant Factual Background C The Proceeding and the Compromise D The Admissions and the Norms Contravened E Misleading and Deceptive Conduct F Principles Regarding Penalties and Joint Submissions G Factors to be Taken into Account in Assessing Penalty H Conclusion

B Relevant Factual Background 7 During the period 1 February 2016 until 10 October 2017 (relevant period), Equifax was a "credit reporting body" within the meaning of the Privacy Act 1988 (Cth) (Privacy Act). In broad terms, this was because it collected "credit information" about individuals to inform credit providers about the "credit-worthiness" of those individuals. The evidence reveals that Equifax was in fact the largest credit reporting body in Australia, both during the relevant period and at the present time. 8 The Privacy Act imposes certain obligations on Equifax, including an obligation to give individuals access to credit reporting information it holds about those indivduals on request (within a reasonable period) and to take reasonable steps in the circumstances to correct that information where Equifax is satisfied that the information is inaccurate, out of date, incomplete, irrelevant or misleading. 9 During the relevant period, in addition to providing services to credit providers, Equifax carried on the business of promoting and supplying fee-based credit reporting services to individuals. These paid packages included a number of services, including providing up to four credit reports per year, which contain the individual's credit reporting information, access to what are described as "credit scores", the delivery of a paid credit report within one business day, and various further information related to managing a credit profile and protecting the identity of the customer. These paid packages were subscription services and the fee paid by an individual entitled that individual to the supply of the services provided in the paid package for a 12 month period. At the end of the 12 month period, the packages were automatically renewed for a further 12 month period, unless there had been prior opting out by the customer. 10 Until the end of 2017, Equifax representatives, including those employed by a contracted service provider, were paid, by way of commission for each sale of a paid package over the telephone. Accordingly, there was a dynamic in place, which encouraged the spruiking of sales over the telephone. This commission incentive operated in the context of the legal requirement that, at all relevant times, Equifax was required to provide reporting information without charge (being the same information as that which was contained in the paid credit report that Equifax provided to individuals as part of its paid packages). Individuals were able to request a free credit report on the Equifax website or in writing. 11 Given the financial incentive to "push" sales, it is hardly surprising that the events to which I am about to turn took place. During the relevant period, Equifax representatives engaged in misleading and deceptive conduct and made false or misleading representations to customers in the course of promoting and selling Equifax's paid packages on the telephone. During this period, there were two principal means by which Equifax sought to promote and sell its paid packages telephonically. First, Equifax had an outbound marketing campaign, which involved Equifax representatives telephoning individuals who had already applied online for a copy of their free credit report and attempting (to use an expression redolent of American sales speak), in an attempt to "upsell" those individuals paid packages. Secondly, when individuals telephoned Equifax to enquire about accessing their credit reports, Equifax representatives attempted to sell paid packages to those individuals. The first of these activities can be described as "outbound calls"; the second as "inbound calls". 12 I pause here to make reference to an issue to which I will return later in these reasons, being the instances relied upon by the ACCC in seeking relief in this proceeding. During the relevant period, Equifax received 148,408 unique inbound calls to the call centres dealing with consumer credit file enquiries. From these inbound calls, 13,834 new sales of paid packages were made (that is, approximately 9% of all unique calls). On average, Equifax received about 860 unique inbound calls per day. At the same time, Equifax made approximately 600 outbound calls per day. Having regard to the evidence before me, this appears to mean that it is likely that there were around 103,500 outbound calls made during the relevant period. Accordingly, it appears that the combination of inbound and outbound calls was somewhere in the region of 250,000 telephone calls. 13 A sample consisting of only 120 recordings of inbound and outbound telephone calls was provided to the ACCC in response to notices issued pursuant to s 155 of the Competition and Consumer Act 2010 (Cth). This was a request for the first five inbound and the first five outbound telephone calls made after 9 am and after 3 pm on 5 and 7 July 2016, 15 August 2016, 7 and 9 February 2017 and 3 March 2017. Although the precise arithmetic is not material, it appears that the sample of telephone calls obtained by the ACCC and analysed for the purposes of these proceedings amounts to less than one-half of 1% of all relevant calls. 14 Having said this, it is common ground between the parties that the sample obtained was statistically significant. Equifax did not make a concession to the effect that the calls were representative, however, there was no reason advanced as to why the calls the subject of the sample should not be taken as being at least broadly representative of all calls. Given that the calls were selected randomly, being a sample admitted to be statistically significant, one can infer that absent any evidence to the contrary, it is likely that the non-sample calls (that is, over 99.9% of total calls), are likely to have the characteristics similar to the sample. I will come back to this issue below. 15 During the course of the sample telephone calls it is common ground that Equifax made false or misleading representations from time to time, which can be summarised as follows: (b) Equifax represented that the Equifax credit score which consumers received as part of the paid packages was the same credit score as that which credit providers used to assess credit applications, extensions of credit or the terms upon which credit would be provided to consumers when, in fact, the true position was: (i) some credit providers did not use the Equifax credit score; (ii) other credit providers used the Equifax score in limited circumstances only; (iii) the Equifax credit score provided to a credit provider may, for various reasons, are different from the credit score provided to a consumer. (c) Equifax represented that its credit report provided as part of its paid packages was more comprehensive than its free credit report when, the truth was, they contained the same information. (d) Equifax represented that consumers would be charged a single "one-off" payment for the services, and failed to disclose that the services automatically renewed on an annual basis when, the truth was, the services were automatically renewed annually and the consumer was charged for further 12-month periods unless the consumer took steps to opt out of the renewal. 16 Additionally, for reasons I will explain below, it is also admitted that Equifax engaged in conduct during its dealings with three consumers that was unconscionable.

C The proceeding and the compromise 17 The investigation of Equifax by the ACCC commenced in early 2017 and the first of the s 155 notices was dated 6 March 2017. Equifax approached the ACCC early in the investigation, in July 2017, to discuss the alleged conduct and outline what the parties described as "proactive steps" that Equifax could take in response to the ACCC's concerns. Equifax also provided information voluntarily in certain circumstances during the investigation when requested by the ACCC. 18 The proceedings were commenced in March 2018 and, at a relatively early stage of the proceeding (shortly after the pleadings had closed) Equifax admitted liability and a paction was reached as to proposed relief. This had the effect of avoiding what might have been lengthy and complex litigation. Before the hearing I was provided with a document, being a statement of agreed facts and admissions, which became Exhibit A on the application. The only other evidence was an affidavit affirmed by Michael John Cutter affirmed on 26 September 2018 together with three annexures to that affidavit. 19 Joint submissions were also provided in advance of the hearing.

D The admissions and the norms contravened 20 I refer above to the three kinds of representations that are admitted to have been made. I will describe those representations as the "lender credit score representation", the "paid credit report representation" and the "one-off payment representation" respectively. I should say something about each of those representations. 21 Lender credit score representation was made in 25% of the sample calls. It is common ground that the conduct involved consumers being told that the credit score that Equifax provided had the benefit of being the same credit score as that which credit providers use to assess credit applications, extensions of credit or the terms upon which credit would be provided to consumers, when this was not in fact the case. The nature of the comment was one which was obviously likely to form part of entreating a consumer to obtain a paid package in circumstances where, at least in some cases, the benefit or necessity for the product was, at best, illusory. 22 The paid credit report representation was made in 3% of sample calls. As I have already indicated, it involved consumers being told from time to time that the paid credit card report provided as part of the paid packages was more comprehensive or somehow better than the free credit report, when it contained the same information. Again, this was a representation clearly designed to make a paid credit report more attractive from the perspective of the consumer than a free credit report. 23 The one-off payment representation was made in 43% of the sample calls. It appears that in some of the sample calls, the representation was made positively, however, in a majority of the relevant sample calls, it appears that the representation is to be inferred contextually from the failure to communicate to the customer that there would be more than one payment for the paid packages. This representation falls into a slightly different category, as it was not a positive incentive in order to encourage customers to enter into the package, but dissembled the true nature of the arrangement to deflect the attention of the customer from the fact that they were incurring a liability that would be repeatedly incurred unless they took positive steps to opt out. 24 Equifax did not dispute the proposition that these representations were serious. Indeed, it is fair to assume that persons who would be making enquiries about their credit score or persons who would have been contacted by Equifax had or were likely to have certain characteristics, including the fact that they were persons who may have been the subject of credit defaults. It is fair to assume that persons with those characteristics were likely to have some degree of financial vulnerability, which makes the conduct of Equifax in making false representations one which should be the subject of specific curial disapproval. The conduct does not reflect well on the company at all. 25 These comments have further resonance if one turns to the unconscionable conduct which has been the subject of admissions. It is worthwhile explaining the unconscionable conduct admitted in some detail. Importantly, this is the only unconscionable conduct which is relied upon by the ACCC. It would be erroneous of me to speculate about or have regard to other instances of unconscionable conduct that may have occurred during the relevant period. Having said that, given the number of calls with customers, it would be naïve of me to conclude that if the other 252,000 calls were the subject of close scrutiny, similar wrongful conduct would not be revealed, but given the (to me at least) surprisingly limited way the ACCC has approached this case, it is necessary to put this aside for present purposes. 26 I will describe the three consumers in respect of whom unconscionable conduct is admitted as TL, MC and OR. I was persuaded to make orders under Part VAA of the Federal Court of Australia Act to prevent prejudice to the proper administration of justice in protecting the identity of the three consumers. 27 The first consumer to which I will turn is TL. During the evening of 19 October 2016, TL unwittingly provided her credit card details to an unknown third party on a fake website. Not unnaturally, TL was distressed by the scam she had fallen into and was concerned her bank accounts would be targeted. That evening, TL reported the incident to ACORN, a national policing initiative of the Commonwealth and other governments which is apparently an online system which allows the public to report such events. Also that evening and on the following day, no doubt still in a state of some distress, TL contacted her banks to explain what had happened, and to ask what she should do to protect herself from fraud. No doubt thinking it would be helpful information, one of the banks recommended that she contact Equifax straight away so as to protect her credit rating. TL had not previously dealt with, or heard of, Equifax, and the bank representative did not provide any further information. 28 TL then called Equifax on 20 October 2016 and explained her predicament and the fact that she was a victim of a "phishing scheme". It is agreed that she was upset and she asked the Equifax representative to give her advice as to her optimal course of action given her express concern that she might be the victim of identity theft. One need only reflect momentarily on the situation that TL found herself in, to realise that she was a woman in a position of some vulnerability. 29 I have not heard the tape, but Exhibit 1 records the agreement of the parties that the Equifax representative told her, among other things, that she should check on her credit report first so that she could "see the most current activities that were done without [her] knowledge". When TL asked the representative how she could achieve that end, the representative told her that Equifax could set up a copy of her credit report within one working day, that it would be activating credit alerts, and it would cost $89.95. When TL asked whether she had to pay for this service, the Equifax representative apparently said that while she could file a credit correction request for free, in order to know the information that might need correcting, she needed her credit report. 30 The parties agreed that it was evident that TL was not aware that Equifax provided credit reports for free. She was not made aware of this option during the course of her discussion with the Equifax representative and was labouring under the misapprehension that in order to obtain her credit report she needed to pay the not insignificant amount of money requested. She was flummoxed as to the nature of the additional services that were to be provided along with the credit report, but was in a state of panic about the possible consequences of the scam she had been exposed to on the fake website. In this context, the Equifax representative said to her: "Now for the payment of 89.95, Ma'am, is your option if you grab it". 31 Against this background, she decided to purchase one of Equifax's paid packages in the belief that she needed her credit report to protect herself from fraud and the only way to obtain it was to purchase it from Equifax. To make matters worse, she was not informed by the representative of the automatic renewal term, nor was she referred to the terms and conditions of the paid package. Somewhat remarkably, she was also told that Equifax was a "public organisation" (whatever that was supposed to mean). 32 TL was later disabused of her misapprehensions by a not-for-profit organisation called IDCARE. She was informed that she had been entitled to a free report and that she could also submit a request for a ban period, which was also free (a ban period means that if a credit provider requests an individual's credit report as part of an assessment of a credit application, Equifax cannot share it unless the individual provides express written consent or if it is required by law). 33 Upon hearing this information, TL called Equifax on 24 October 2016 to request a refund, explaining that she felt she had been misled and that she had understood, after speaking with IDCARE, that she was entitled to a free report and she could submit a request for a ban period, which was also free. 34 Equifax refused to provide a refund. Moreover, an Equifax representative agreed to review the call recording from when the Equifax subscription product was bought and "assured" TL that a supervisor would be in contact with her regarding the outcome. Again, remarkably, Equifax failed to contact TL about the outcome of any such investigation. 35 On 15 December 2016, after hearing about a decision of the Office of the Australian Information Commissioner (being a decision upon which a number of representative complaints against Equifax were found to be substantiated under s 52(1)(b) of the Privacy Act: see [2016] AICmr 88 (9 December 2016)), TL again asked whether a refund would be provided. Again, she was refused a refund and was not even provided with an explanation for the lack of communication with her. 36 By this stage, TL had sufficiently understood what had occurred to allow her to cancel her subscription, which meant that Equifax deactivated her subscription before it was renewed. 37 The evidence discloses that it was not until 21 September 2018 that a communication was sent by Equifax which provided a satisfactory outcome of TLs request for a refund. That letter was in the following terms: I write in relation to your experience with Equifax to obtain a copy of your credit report. I am aware that in 2016 you had several discussions with Equifax in relation to accessing a copy of your credit report. I want to personally apologise for the unsatisfactory service you received during those discussions. It is not the standard we want to set and I can assure you we are making improvements. I would like to send you a refund cheque for the services you purchased from Equifax at that time. If you could please confirm your postal address to me via return email, I will ensure it is posted via Express Post in the coming days. We are committed to always reviewing and improving our services so that we can support Australian consumers. Sincerely, Mike Cutter Group Managing Director, Australia and New Zealand. 38 It took until six days prior to this hearing for TL's request for a refund (first made almost two years ago) to be dealt with. I will come back to the terms of the letter of Mr Cutter later in these reasons and note for present purposes that a letter in identical terms was sent to two other customers who were the subject of the admitted unconscionable conduct. 39 I now turn to the customer MC. MC is a single mother of two. Prior to her dealings with Equifax, she had been declared bankrupt. At the times of her dealings with Equifax, MC was on a limited income and had concerns about personal debt. Just prior to her dealings with Equifax, no doubt in an attempt to obtain assistance as to her financial vexation, MC had met with a counsellor provided by a local charity in Wagga Wagga for people who were having difficulty managing their finances. The financial counsellor helped MC prepare a weekly budget and informed her that she could obtain a free credit report from Equifax in order to have a better understanding of her outstanding debts. 40 MC applied for a free report online on 11 August 2017. On 14 August 2017, an Equifax representative contacted her and told her the call was a "courtesy from the marketing department of Equifax to extend our help to you with whatever reason why you have requested for [sic] a free report from us". The notion that the telephone call was a courtesy, or it could be properly characterised as extending help, is particularly galling. Soon after this comment was made, an Equifax representative made the lender credit score representation which, as will be recalled, was that the credit score that Equifax provided as part of its paid packages had the benefit as being the same credit score that would be used by credit providers to assess credit applications. 41 When one considers the personal circumstances of MC, one could see why such a representation would be subjectively important. Here was a woman who had faced the social stigma of bankruptcy in her past and was trying, with the help of the charitable endeavours of others, to get her life back on track in managing her finances. 42 Indeed, this was explained to the Equifax representative. MC told the representative that she had sought the help of a financial advisor in dealing with some debts and that applying for a credit report was one of the steps they had taken. She had explained that paying off her debts was a "priority". 43 One would have thought that in these circumstances that even a person who stood to obtain the financial gain of commission might have had some pause in "upselling" a product. Alas, what occurred is that the Equifax representative represented it would take 10 days for the free report to be provided and informed MC that she was receiving a price that was a "limited time offer only". Presumably in an effort to make MC believe that she was obtaining a good deal. 44 In response, MC said she wanted to "check with [her] financial advisor" and that she was in a "tough situation at the moment where I don't have a lot of money". She then repeated that she needed to "touch base with [her] financial advisor". The call was concluded on the basis that MC would call Equifax back if she wanted to "check [her] credit score as well". 45 One might have thought that this was the end of it. It was not. Over the course of that day, and the following seven days, MC received at least seven further telephone calls from Equifax. Not surprisingly, MC felt harassed. During one of the later calls the Equifax representative said that with a paid package MC would have access to credit correction services, and that if she performed a credit check on herself it would leave a "mark" on her file and "damage" her score. This was a falsehood. 46 Indeed, the harassment was such that MC's financial advisor called Equifax on her behalf to request that Equifax cease calling MC in an attempt to "upsell" its product. Not daunted, Equifax representatives did not even stop calling MC at this time. 47 No doubt because of the assistance that MC had received from the commendable activities of a local charity, MC did not purchase the paid package from Equifax. 48 The third customer, OR, has limited understanding of English as it is not her first language. On 16 August 2016, OR applied for a copy of her free credit report. Two days later she received a telephone call from Equifax. At the outset of the call, the Equifax representative told OR: I'm just calling in relation to your request for the copy of your credit report that was this Tuesday. Do you remember that? . . . So, just calling in relation to your request for the report, and actually, you haven't stated any reasons in here why you wanted to check for it. So would you mind me asking what's the reason why you wanted to request your credit file? OR responded: Oh, actually, my husband [sic] idea, he want to do the, check the, the credit because he worry someone gonna, um, you know, go through the mail and, um, ah, steal identity and make a credit and that's, that's what he worry about, yeah. The Equifax representative then went on to say: So, this is the reason why we've called, Ms [OR], because we are promoting credit awareness at this stage, because every time that we provide a credit report this year, we make sure that that includes the information about your credit score together with it. Are you aware what a credit score is? 49 Not surprisingly, OR did not understand what the Equifax representative was saying. This was or should have been apparent to the Equifax representative from her responses. The substance of the above statement was repeated two or more times but OR's further responses indicated she did not understand what was being discussed. 50 The Equifax representative then proceeded to explain what a credit score was. In so doing she made the lender credit score representation. She then asked OR: So, that's why since you've already requested your report, Ms [OR], we can even include information about your credit score together with it. Okay. And it's not only the numbers that we will be giving to you. 51 During the course of the call, OR demonstrated difficulty in understanding the Equifax representative and her responses were confined to "Okay" or "Yeah". Despite this, the Equifax representative spoke quickly, in long sentences, and used a significant number of technical terms. In the middle of one passage of information, the Equifax representative said: Originally we provide this for about $89.95, but at the moment we can give this to you for just a one-time fee of $74.95 and that's already good for one whole year, so you can even receive your report and your credit score within one working day, provided that we all have your details. 52 The Equifax representative did not inform OR about the automatic renewal term, nor did she refer to the applicable terms and conditions of the paid package. Following OR's next affirmative response, the Equifax representative then said: So, that's why, yes, so that's why since you've already filled out a form on our website this Tuesday, so all we'll have to do is confirm some of your information and we can even provide you your logon details for you to access it on our website, okay. 53 The Equifax representative then proceeded to request personal information from OR, including her credit card details. Prior to requesting those details, OR told her that she had lost her job. She also asked whether it was safe to give out her credit card number but was reassured that she did not have to give out her three-digit security number. OR understood that she was providing her credit card information as part of the credit check process and did not understand that the Equifax representative was processing a payment for one of Equifax's paid credit reporting packages. She understood that no charges could be made without the three-digit security number. 54 After the call, OR realised that her understanding had been mistaken and that her credit card had been charged by Equifax. Over the following 24 hours, she and her husband called Equifax a number of times to explain a mistake had been made, and OR did not want the paid package for which she had been charged. She also told Equifax that she had difficulty understanding what she was told on the telephone call as English was not her first language. Despite the above, Equifax refused to provide a refund. 55 The conduct to which I have just referred is described by Mr Cutter as "unsatisfactory service" and he noted that it is: Not the standard we want to set, and I can assure you we are making improvements. 56 This was a risible understatement. All three examples involve conduct that was plainly unconscionable and made worse by the fact that it was visited upon people who either were in evident financial distress or had difficulty understanding English. Indeed, it is no exaggeration to describe the three examples of conduct discussed as disgraceful.

E misleading and deceptive CONDUCT 57 As is well known, s 18(1) of the ACL provides that: A person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive. 58 Section 29(1) relevantly prohibits the making of false or misleading representations, in particular, a person must not: (g) make a false or misleading representation that goods or services have sponsorship, approval, performance characteristics, accessories, uses or benefits; or (i) make a false or misleading representation with respect to the price of goods or services; or (l) make a false or misleading representation concerning the need for any goods or services. 59 It would be surplusage for me to set out in detail the principles that inform a consideration of whether conduct contravenes the statutory norms. The law is very well known and it suffices to note that conduct is misleading or deceptive if it has a tendency to lead a consumer into error. The authorities are replete with references to the fact that it is necessary for there to be a contextual analysis which requires characterisation of the conduct in question and what occurred as an objective determination of whether the tendency to lead into error is evident. As I said in Australian Competition and Consumer Commission v Apple Pty Ltd (No 4) [2018] FCA 953 at [32]: [These] are critical remedial provisions and have been (in a somewhat different form) a centrepiece in commercial life in this country for a period of well over 40 years. They are remedial and protective provisions which ensure that, if commerce is conducted in Australia, it be done in such a way as to avoid prohibited conduct. Put in colloquial terms, the provisions require persons, in trade and commerce, to play with a straight bat. 60 Part 2-2 of the ACL deals with unconscionable conduct. Section 21 is in the following terms: (1) A person must not, in trade or commerce, in connection with: (a) the supply or possible supply of goods or services to a person (other than a listed public company); or (b) the acquisition or possible acquisition of goods or services from a person (other than a listed public company); engage in conduct that is, in all the circumstances, unconscionable. 61 Obviously enough, the term "unconscionable" derives from the equitable concept of unconscionability and constitutes conduct that is against good conscience, irreconcilable with what is right and reasonable, and conduct which attracts a sufficient level of judicial disapproval to support the grant of relief. 62 The parties agree that the conduct to which I have made reference is appropriately characterised as being conduct which amounts to contraventions of these important statutory norms. They were right to do so.

F PRINCIPLES REGARDING PENALTIES AND JOINT SUBMISSIONS 63 In Australian Competition and Consumer Commission v Pental Limited [2018] FCA 491 at [40]-[52] I set out the statutory provisions in respect of which a pecuniary penalty may be imposed and the relevant factors which inform a determination of such penalties, as follows: Under s 224(1)(a)(ii) of the ACL, a pecuniary penalty may be imposed at the court's discretion for any act or omission that contravenes ss 29(1)(a), 29(1)(g) or 33 of the ACL (of course, the other contravention relied upon by the ACCC, that of the norm referred to in s 18 of the ACL, does not give rise to liability for pecuniary penalties). At times material to the determination of the pecuniary penalties in this proceeding, s 224(3) provided that for a body corporate, the maximum penalty for each contravention of ss 29(1)(a), 29(1)(g) and 33 is $1.1 million. Pursuant to s 224(4) of the ACL, if the same conduct constitutes a contravention of two or more provisions, a person is not liable to more than one pecuniary penalty in respect of that conduct. Guidance as to the exercise of the discretion is provided by s 224(2) of the ACL, which provides that in determining the appropriate pecuniary penalty, the court must have regard to all the following matters (mandatory s 224 factors): (a) the nature and extent of the act or omission and of any loss or damage suffered as a result of the act or omission; and (b) the circumstances in which the act or omission took place; and (c) whether the person has previously been found by a court in proceedings under Chapter 4 or Part 5-2 to have engaged in any similar conduct. The mandatory s 224 factors are broad ranging. As Edelman J observed in Australian Competition and Consumer Commission v RL Adams Pty Ltd [2015] FCA 1016 at [40]: There will be very few facts that are not included within the breadth of these matters. For instance, the "circumstances" in which the act takes place includes circumstances which precede the act as well as those which are contemporaneous to it. Additionally, the cases have identified a number of matters which can be taken into account under s 224 of the ACL. In Australian Competition and Consumer Commission v Singtel Optus Pty Ltd (No 4) [2011] FCA 761; (2011) 282 ALR 246 (Singtel Optus (No 4)) at 250-251 [11], Perram J described a number of matters which could be taken into account under a similar provision. It is important to stress that the factors identified by Perram J serve as general guidance and do not establish some sort of prescriptive list. Having said this, the factors do provide a useful checklist of matters which may have applicability depending upon the individual circumstances of the given case. The factors are: (1) the size of the contravening company; (2) the deliberateness of the contravention and the period over which it extended; (3) whether the contravention arose out of the conduct of senior management of the contravener or at some lower level; (4) whether the contravener has a corporate culture conducive to compliance; (5) whether the contravener has shown disposition to cooperate; (6) whether the contravener has engaged in similar conduct in the past; (7) the financial position of the contravener; and (8) whether the contravening conduct was systematic, deliberate or covert. To these factors, Edelman J, in RL Adams at [42], added the following: (1) whether the contravener made a profit from the contraventions; (2) the extent of the profit made by the contravener; and (3) whether the contravener engaged in the conduct with the intention to profit from it. I will return to the mandatory s 224 factors below. I will also return to these additional, or, perhaps more accurately, more granularly expressed factors, to the extent that they seem to me to be of significance in determining the pecuniary penalties in this proceeding. C.2 Fixing Penalties C.2.1 General Principles There was no substantial dispute between the parties as to the relevant principles to be applied. Given the recent discussion of the applicable principles in Australian Competition and Consumer Commission v Australia and New Zealand Banking Group Ltd [2016] FCA 1516; (2016) 118 ACSR 124 at 141-142 [78]-[83] (Wigney J) and by the Full Court (Dowsett, Greenwood and Wigney JJ) in Australian Building and Construction Commissioner v Construction, Forestry, Mining and Energy Union [2017] FCAFC 113; (2017) 271 IR 321 at 341-353 [96]-[149] (ABCC v CFMEU), there is limited utility in me setting out, except by way of brief summary, the applicable principles. It is clear that the principal object of a pecuniary penalty is to attempt to put a price on a contravention that is sufficiently high to deter repetition by the contravener and by others who might be tempted to contravene. In this sense, both specific and general deterrence are important: see ABCC v CFMEU at 341 [98]. Given these objects, a pecuniary penalty ought be fixed with a view to ensuring that the penalty cannot be regarded by either the contravener or by others as simply an acceptable cost of doing business: see Australian Competition and Consumer Commission v TPG Internet Pty Ltd [2013] HCA 54; (2013) 250 CLR 640 at 659 [66] (French CJ, Crennan, Bell and Keane JJ). In relation to general deterrence, it is important to send a message that contraventions of the law are unacceptable: see Australian Securities and Investments Commission v Southcorp Limited (No 2) [2003] FCA 1369; (2003) 130 FCR 406) at 418 [32] per Lindgren J. As to fixing the pecuniary penalty, this involves the identification and balancing of all factors relevant to the contravention, including, necessarily, the mandatory s 224 factors, and ultimately making what has been described as a "value judgment" as to what is the appropriate penalty in light of the protective and deterrent purpose of the pecuniary penalty: see ABCC v CFMEU at 342 [100]. Put generally, the factors that are relevant when fixing a pecuniary penalty relate to both the objective nature and seriousness of the contravening conduct and the particular circumstances of the contravener. As to objective seriousness of the contravention, matters for consideration include the extent to which the contravention was the result of deliberate, covert or reckless conduct (as opposed to carelessness);whether the contravening conduct was isolated or systematic; the duration of the conduct and, in circumstances where the contravener is a corporation, the seniority of the officers responsible; and the existence of systems within that corporation which are indicative of whether there was a culture of compliance. As the mandatory s 224 factors make clear, it is also relevant to have regard to the loss or damage suffered as a result of the contravening conduct (see s 224(2)(a)). The obverse is also true: it is appropriate to look at the extent of profit, if any, which results from the contravening conduct. This last factor, of course, not only relates to objective seriousness, but also concerns the particular circumstances of the malefactor. I have already made reference to the list of factors to which one has regard in fixing a penalty in relation to a corporate contravener, including its size, financial circumstances and related matters. Of course, in having regard to the particular financial circumstances of a corporation, the size of the corporation does not itself justify a higher penalty than might otherwise be imposed: see Australian Competition and Consumer Commission v Coles Supermarkets Australia Pty Ltd [2015] FCA 330; (2015) 327 ALR 540 (ACCC v Coles) at 559-560 [89]-[92] per Allsop CJ. But the corporation's size may be thought, logically, to be highly relevant to the question of the size of the penalty that should operate in order to properly give effect to the need for specific deterrence. 64 As to joint submissions, the applicable principles as to the making of orders by agreement were summarised by Gordon J in Australian Competition and Consumer Commission v Coles Supermarkets Australia Pty Limited [2014] FCA 1405 at [70]-[72]: The applicable principles are well established. First, there is a well-recognised public interest in the settlement of cases under the Act: NW Frozen Foods Pty Ltd v Australian Competition and Consumer Commission (1996) 71 FCR 285 at 291. Second, the orders proposed by agreement of the parties must not be contrary to the public interest and at least consistent with it: Australian Competition and Consumer Commission v Real Estate Institute of Western Australia Inc [1999] FCA 18; (1999) 161 ALR 79 at 86 [18]. Third, when deciding whether to make orders that are consented to by the parties, the Court must be satisfied that it has the power to make the orders proposed and that the orders are appropriate: Real Estate Institute at [17], [20] and Australian Competition & Consumer Commission v Virgin Mobile Australia Pty Ltd (No 2) [2002] FCA 1548 at [1]. Parties cannot by consent confer a power to make orders that the Court otherwise lacks: Thomson Australian Holdings Pty Ltd v Trade Practices Commission (1981) 148 CLR 150 at 163. Fourth, once the Court is satisfied that orders are within power and appropriate, it should exercise a degree of restraint when scrutinising the proposed settlement terms, particularly where both parties are legally represented and able to understand and evaluate the desirability of the settlement: Australian Competition & Consumer Commission v Woolworths (South Australia) Pty Ltd (Trading as Mac's Liquor) [2003] FCA 530 at [21]; Australian Competition & Consumer Commission v Target Australia Pty Ltd [2001] FCA 1326 at [24]; Real Estate Institute at [20]-[21]; Australian Competition & Consumer Commission v Econovite Pty Ltd [2003] FCA 964 at [11] and [22] and Australian Competition & Consumer Commission v The Construction, Forestry, Mining and Energy Union [2007] FCA 1370 at [4]. 65 I should make further reference to the decision of the High Court in Director, Fair Work Building Industry Inspectorate, where the High Court held it was open for the Court to receive submissions, including joint submissions, as to the appropriate penalty and made reference to the scope given to parties to agree on an appropriate remedy, but, importantly, noted the necessity for the Court to be persuaded that the agreed approach is an appropriate remedy.

G Factors to be Taken into Account in Assessing Penalty 66 Section 224(1)(a)(i)(ii) of the ACL provides that if the Court is satisfied that a person has contravened a provision of Part 2-2 (which includes s 21) and/or Part 3-1 of the ACL (which includes s 29), the Court may order the person to pay such pecuniary penalty, in respect of each act or omission by the person to which the section applies, as the Court determines to be appropriate. The ACL does not empower the Court to impose a pecuniary penalty for a contravention of s 18 of the ACL. 67 Guidance as to the exercise of the discretion is provided by s 224(2) of the ACL, which provides that in determining the appropriate penalty, the Court must have regard to three mandatory factors. Those s 224 factors are: (a) the nature and extent of the act or omission and of any loss or damage suffered as a result of the act or omission; (b) the circumstances in which the act or omission took place; and (c) whether the person has been found to engage in any similar conduct. 68 The mandatory s 224 factors are broad ranging. As Edelman J observed in Australian Competition and Consumer Commission v RL Adams Pty Ltd [2015] FCA 1016 at [40]: There will be very few facts that are not included within the breadth of these matters. For instance, the "circumstances" in which the act takes place includes circumstances which precede the act as well as those which are contemporaneous to it. 69 Additionally, as I explained in Pental at [44]-[45]: Additionally, the cases have identified a number of matters which can be taken into account under s 224 of the ACL. In Australian Competition and Consumer Commission v Singtel Optus Pty Ltd (No 4) [2011] FCA 761; (2011) 282 ALR 246 (Singtel Optus (No 4)) at 250-251 [11], Perram J described a number of matters which could be taken into account under a similar provision. It is important to stress that the factors identified by Perram J serve as general guidance and do not establish some sort of prescriptive list. Having said this, the factors do provide a useful checklist of matters which may have applicability depending upon the individual circumstances of the given case. The factors are: (1) the size of the contravening company; (2) the deliberateness of the contravention and the period over which it extended; (3) whether the contravention arose out of the conduct of senior management of the contravener or at some lower level; (4) whether the contravener has a corporate culture conducive to compliance; (5) whether the contravener has shown disposition to cooperate; (6) whether the contravener has engaged in similar conduct in the past; (7) the financial position of the contravener; and (8) whether the contravening conduct was systematic, deliberate or covert. To these factors, Edelman J, in RL Adams at [42], added the following: (1) whether the contravener made a profit from the contraventions; (2) the extent of the profit made by the contravener; and (3) whether the contravener engaged in the conduct with the intention to profit from it. 70 It is the second of the mandatory s 224(2) considerations which has caused me some concern in the present circumstances. As I noted above, the contravening conduct revealed in the sample call accounts were only less than half a per cent of all calls during the relevant period. Absent some ability to extrapolate from the sample to draw conclusions about how systemic the impugned conduct was, it is logically difficult to see how one could have regard to the circumstances in which the acts took place. I raised this issue with senior counsel for both the ACCC and Equifax. 71 Both accepted the proposition that the sample was statistically significant. It seems to me to follow, as a matter of logic, that I should work on the basis that the sort of percentages referred to in the sample are likely to be representative of a broader system of conduct, although it is unnecessary to make any definitive findings about this, save that it seems to me that any analysis of the circumstances must take into account that what was occurring was systemic contravening conduct. The parties organised their joint submissions by addressing three matters in turn: (a) the primary object of imposing penalties, namely, the need to secure deterrence; (b) the grouping of multiple contraventions of s 29 into courses of conduct; and (c) the assessment of an appropriate penalty for each of those courses of conduct, and for each contravention of s 21. 72 It is convenient that this judgment deal with penalty in the same way, noting that in the context of dealing with those matters, it would be necessary to have regard to not only the mandatory s 224(2) factors but also the additional matters referred to in Singtel Optus (No 4) to which I have made reference above.

G.1 Primary Purpose - Ensuring Deterrence 73 It is plain that the primary purpose of civil penalties is to secure deterrence and that they are protective in promoting the public interest in compliance. Deterrence, of course, has two aspects, both specific and general, and its principal object depends upon the pecuniary penalty having a necessary "sting" to secure the deterrent effects that are the raison d'être of its imposition: see Australian Building Construction Commissioner v Construction, Forestry, Mining and Energy Union [2018] HCA 3; (2018) 92 ALJR 219 at 241-242 [116]. 74 The principles have been oft repeated and do not require further elaboration, but I should deal separately with general deterrence and specific deterrence in the circumstance of this case. The parties agreed that three factors point to the need for a penalty which will deter other businesses which may be tempted to contravene in a similar way as Equifax. 75 First, the conditions in which the relevant conduct occurred continue to exist. The credit reporting system enables credit reporting bodies to gather significant amounts of data relating to individuals, and puts them in a position where they may charge consumers for certain forms of access to that personal information. There are specific risks in this industry that companies may mislead individuals about the need to, or benefits of, paying for personal credit information instead of relying on the information to which they may be entitled without charge pursuant to the provisions of the Privacy Act. 76 Secondly, a credit reporting business should be left in no doubt that a strong compliance programme, sufficient to pick up and address conduct of the present kind, is not an optional extra. If the burden of a penalty is seen to be less than the cost and effort of putting in place relevant safeguards, businesses may be tempted to absorb the risk of being caught rather than ensuring that they put in place sufficient safeguards to ensure compliance. Such an approach would give a perverse advantage to contravening companies over those which take on the proper costs of compliance. 77 Thirdly, the penalties proposed in the present case can be expected to be of interest to credit reporting businesses, consumers and, perhaps to a lesser extent, the public more broadly. Accordingly, the imposition of appropriate deterrent penalties in the present case ought send a warning to non-compliant businesses and validate the behaviour and efforts of those that are compliant. 78 In relation to specific deterrence, the parties, in my view, correctly again emphasise three matters. 79 First, Equifax has gleaned a profit from its wrongdoing. It has had the financial benefit of customers buying its packages through or by reason of its contravening conduct. The commercial drivers for the contraventions are, accordingly, still present. 80 Secondly, although the evidence as to the state of the systems within Equifax is not set out in any great detail in Exhibit A, the compliance programme was self-evidently insufficiently robust to prevent the malefaction of Equifax. 81 Thirdly, the Court has recognised that the agreement for the contravener to be enjoined (as is the case here) cannot be seen as necessarily demonstrating the party is unlikely to engage in conduct again, although specific deterrence is no longer a factor for the Court to consider on the assumption that parties will act in accordance with the Court's orders. 82 Balanced against all this, however, is the evidence of Mr Cutter, accepted by the ACCC, that Equifax has made improvements to its consumer credit reporting business during the course of 2017 and 2018, including after the ACCC had begun to investigate its conduct but before this proceeding had been commenced. I accept the unchallenged evidence of Mr Cutter that in 2017 and 2018, Equifax has been under the direction of a senior leadership team which has made a number of improvements to its practices. These improvements are set out in Exhibit A and are unnecessary to detail here. Mr Cutter gives evidence, which I accept, that Equifax is committed to further improvements, including implementing a new monthly subscription for its paid packages in addition to its annual subscription offering, improving cancellation and complaint options through phone and website channels, implementing processes for customers purchasing paid packages over the phone to be apprised properly of the terms and conditions of purchase, improving the content and presentation of credit education material on its websites, developing scripts for inbound call centre representatives and reviewing and updating training for call centre representatives. 83 More significantly, from my perspective, was the action taken in January 2018 of Equifax ceasing to pay commissions to inbound call centre representatives who sold paid credit report packages to customers. This is a highly significant factor in my view, as I strongly suspect that this incentive to "upsell" may be the source of the real problem in this case.

G.2 Imposing penalties for multiple contraventions 84 It is important to remember that what I am describing here as multiple contraventions is the grouping of multiple contraventions of s 29 of the ACL into courses of conduct. Further, this only refers to those contraventions which are the subject of the pleaded case of the ACCC (that is, contraventions that are evident from the very small sample of calls that have been the subject of examination). 85 It is no part of my role to question this enforcement decision or have regard to any other contraventions other than those that are relied upon by the ACCC when it comes to fixing penalty. I have already referred to the evidence concerning the percentage of the sample calls in which the three types of representations were made. As has already been demonstrated by my recounting of the exchanges in the context of the unconscionable conduct case, not all calls during which representations were made resulted in the sale of the paid package to a consumer. 86 A useful starting point of any application of the course of conduct principle is to remind oneself that it is not an entirely separate principle from the totality principle, which requires that penalties do not exceed what is proper for the entire contravening conduct: see Australian Competition and Consumer Commission v Baxter Healthcare Pty Limited [2010] FCA 929 at [22] per Mansfield J. In identifying a course of conduct, it is necessary to emphasise that this is merely a discretionary tool or analytical expedient along the way to determining an appropriate penalty. A precise allocation of the number of courses of conduct is not some sort of calculus which results in various outcomes, depending upon the characterisation of the contravening conduct, as falling into one or other of the identified courses of conduct: see Pental [60] and Apple [39]. 87 In this case I accept the joint submissions of the parties that as a matter of analysis it makes sense to group the contravening conduct into six groupings: (a) the lender credit score representations; (b) the paid credit report representations; (c) the one-off payment representations; (d) the unconscionable conduct involving TL; (e) the unconscionable conduct involving MC; and (f) the unconscionable conduct involving OR. I pause to note that, as is evident from my detailed recount of the unconscionable conduct, the impugned conduct involved a number of acts, including instances of the making of the lender credit score representation and the one-off payment representation. 88 It is also important to recall that s 224(4) the ACL requires that penalties not be imposed twice for the same conduct, and it accordingly follows that Equifax is not to be penalised for both the unconscionable conduct and for misleading conduct that was part of the unconscionable conduct. The parties, I am told, have taken this into account for the purposes of reaching their agreement as to proposed penalties. 89 Accordingly, it is appropriate to deal separately with the 86 instances of false or misleading representations not forming any part of the unconscionable conduct (s 29 contraventions). Although recognising that this was contravening conduct which was directed to different customers and hence involves separate acts, the nature of the contraventions are able to be properly characterised as one course of conduct. Having said this, there were three quite distinct types of s 29 contraventions and hence, for the purposes of analysis, it is proper to characterise the s 29 contraventions as involving three separate courses of conduct. 90 The Full Court in Australian Building and Construction Commissioner v Construction, Forestry, Mining and Energy Union [2017] FCAFC 113, (2017) 254 FCR 68, dealt with the admissibility of imposing a single pecuniary penalty for multiple related contraventions, albeit in the context of a different statutory scheme. The Full Court recognised that the Court retains a discretion to accept a single penalty for multiple contraventions (at 99 [145]): ... where the parties jointly propose to the Court that, having regard to the particular facts and nature of the contraventions, it would be appropriate to impose a single penalty, or to group the contraventions in terms of separate courses of conduct and impose single penalties in respect of those groups, the Court may accept that proposal and order a single penalty, or single penalties in respect of groups of contraventions. 91 Needless to say, in these circumstances it is still necessary to act in accordance with the totality principle which requires the Court to make a final check of the penalties to be imposed considered as a whole. The application of that principle in the circumstances of this case is, however, affected by the point with which I commenced, and that is the important public policy of encouraging corporations to acknowledge contraventions and the scope provided to parties to agree upon an appropriate remedy, and for the Court to be persuaded that it is an appropriate remedy.

G.3 Determining an Appropriate Penalty 92 I have already explained the relevant factors, but it is appropriate that I return to the relevant principles under three headings: (a) the statutory minimum, (b) the mandatory factors and (c) a synthesis of the relevant factors.

G.4 Statutory minimum 93 The maximum penalty for contraventions by a company of the provisions of Part 3-1 of the ACL is $1.1 million. This same maximum penalty exists for a company's contravention of the provisions of Part 2-2 of the ACL. The maximum penalty for a single contravention, while not binding, can be used as a guide against which to consider the whole of the "overlapping" conduct properly characterised in accordance with the course of conduct principle: see Australian Competition and Consumer Commission (ACCC) v Coles Supermarkets Australia Pty Ltd [2015] FCA 330; (2015) 327 ALR 540 at 558 [82].

G.5 Mandatory factors 94 As noted above, I am required to have regard to "all relevant matters" in determining an appropriate penalty, including the mandatory factors to which I have referred. Even though I have identified the various considerations which have been referred to in the cases as being potentially relevant considerations, little utility is served by going through the factors individually and assessing the contravening conduct by reference to each. 95 It seems to me that the penalty factors of particular importance in the circumstances of this case are the size and financial position of the contravener, whether the wrongdoing was systemic, whether it involves senior management and whether the contravener has its corporate culture conducive for compliance with the ACL. Added to this, of course, is the extent of cooperation with the regulator and, when assessing specific deterrence, whether or not I am satisfied on the basis of the evidence that Equifax understands the seriousness of the conduct in which it has engaged. 96 In relation to the financial position of the contravener, the evidence discloses that for the year ended 30 June 2017 Equifax had a revenue of $282.8 million with a net profit of $94.6 million. For the financial year 30 June 2016 the equivalent figures were $263.9 million for revenue and $45.4 million for profit. Additionally, at the end of financial year 30 June 2017 the assets of Equifax Group operations were $2.553 million with liabilities of $1.713 million. 97 As to the relative importance of the revenue that was obtained by engaging in the contravening conduct, Exhibit A discloses in the financial year ending 30 June 2017 Equifax made $2.170 million in revenue selling paid packages over the telephone, of a total $14.341 million revenue from sales of paid packages. Accordingly, the amount generated from selling packages over the telephone (the present relevant conduct) is less than 1% of the overall figures for the group. This seems to me to be a matter of some significance when it comes to assessing penalty. 98 As to whether the wrongdoing was systemic, I am satisfied that it was. The pattern of contravening conduct in the sample shows repeated instances of conduct which falls short of that which is to be expected by a company acting in compliance with acceptable corporate standards. This reflected a corporate culture which was not sufficiently compliant with the ACL. 99 Balanced against this is the evidence to which I have already referred, which demonstrates that there has been somewhat of a change in the way in which Equifax has approached its affairs under the direction of a senior leadership team. Having said that, I remain concerned by the tardiness with which Equifax has dealt with the three persons in respect of whom it has engaged in quite egregious conduct and the tone of the letters accompanying the refunds which, in my view, are jarring for a lack of appreciation of the seriousness of the conduct. 100 Accordingly, although I accept that the senior leadership team genuinely wishes to undertake changes to ensure compliance with the ACL, this is not a recognition which is one that seems to trump the desire to communicate with customers in a way which, to an objective reader, minimises the extent of the wrongful behaviour. I must say, this factor has caused me a good deal of concern in assessing whether or not I should accept the proposition that the agreement reached is one which can be accurately described as an appropriate remedy. 101 Left to my own devices, even with the limited investigation of the ACCC into only a very small number of calls, and unassisted by the joint submissions, I would have thought that the conduct was such that would have attracted a penalty which was greater than that proposed in order to bring home to Equifax the very serious nature of the unconscionable conduct case in particular. It is disturbing that persons who are likely to be financially vulnerable could have been the subject of such behaviour. Having said this, these concerns are not sufficient for me to reach a level of satisfaction that the agreement does not reflect an appropriate penalty and, given the powerful policy considerations referred to by the High Court in Director, Fair Work Building Industry Inspectorate, I am persuaded that it is consistent with principle and highly desirable for me to accept the parties' proposal and therefore impose the proposed penalty.

H Conclusion 102 During the course of exchange with counsel during the course of the hearing today I expressed some misgivings about the current consumer redress regime which forms part of the suite of orders which are proposed. It is important I explain my approach to this matter in a little detail. The consumer redress regime was jointly proposed by the parties to implement a process which would follow the publication of a corrective notice. The corrective notice, which was to be published on the website and sent to the last known email address of potentially affected customers, would apprise the customer of the contravening conduct and information as to whether or not they may be eligible for a refund. 103 Following the publication of the corrective notice, it was proposed the affected customers would contact Equifax and that Equifax would assess such a claim and would provide a refund where, having regard to the relevant call recording, an Equifax representative made one of the relevant representations. 104 It was then proposed that Equifax would appoint a suitably qualified independent professional who would assess whether the refusal to grant a refund in an individual case was one that was justifiable, with the third stage being a review of the entire process by a firm of solicitors. 105 The workability of the consumer redress regime is an important discretionary factor to which I have had regard in setting the appropriate penalty. Having said this, I do wish to ensure that the process works in accordance with the contemplation of the parties and the Court. In the context of notices served in accordance with Part IVA of the Federal Court of Australia Act 1976 (Cth), concerns have often been expressed about the ability of recipients of notices to appreciate what has been communicated to them and to respond appropriately to notices. 106 Here we have a situation where, if the sample is sufficiently statistically significant, one has a very rough idea of the likelihood of potentially affected consumers. One cannot take this too far, but it seems to me it may be possible, by reference to the response to the corrective notice, to get some idea as to whether the messages in the corrective notice have been adequately communicated and, following contact from consumers, it should be possible to judge whether the refund process has been conducted in accordance with what I accept is the intention of Equifax at the time they agreed to the orders. 107 In these circumstances, both parties agreed, after obtaining instructions, that they had no objection to the proposed review process being amended in two material respects. The first is for the Court to appoint a suitably qualified independent professional who would review any refusal by Equifax to provide a refund to any customer who has contacted Equifax in an attempt to engage in the consumer redress regime. The second is that instead of having a third level of review, being the proposed review by solicitors, the court-appointed professional can provide a report to both the ACCC and the Court as to precisely what has occurred in relation to the process. 108 I then propose, in the absence of any objection, to grant liberty to the ACCC to restore the proceeding within a period following the conclusion of the process if the ACCC has formed the view that the process has miscarried. 109 It is important to emphasise that the conclusion I have reached about penalty has embedded within it the notion that the consumer redress regime will operate properly and provide an effective mechanism for consumers affected by the wrongful conduct of Equifax to have redress. This was an important mitigating factor which was part of the discretionary mix in reaching the ultimate conclusion to accept the parties' submissions on penalty. 110 If this process was to miscarry, it would not involve any question of revisiting penalty, but it might involve, subject to hearing further from the parties, the Court taking remedial steps to ensure that the consumer redress process is undertaken in accordance with what I am told is the joint intention of the parties. In the unusual circumstances of this case, this further supervision seems to me to be appropriate. 111 In these circumstances, after making the orders that I am about to make, I would not dismiss the proceeding but, rather, grant liberty for the ACCC to apply and, in the event that the consumer redress process operates effectively and no leave is exercised, the proceeding will then be dismissed. 112 I should also note that Equifax has agreed as part of the orders to make a contribution of $100,000 to the ACCC in respect of the applicant's costs of and incidental to the proceeding. I certify that the preceding one hundred and twelve (112) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Lee.