Australian Competition and Consumer Commission v Google LLC

Federal Court of Australia|2022-08-12|Before: Mr P, Thawley J

The Federal Court approved a $60 million penalty against Google for misleading Australian consumers about how it collected and used their location data. Google had shown misleading screens to users of Android phones between 2017 and 2018, making them think their location data wasn't being collected when certain settings were turned off. The Court found this breached consumer laws against misleading conduct. Because there were potentially over a million contraventions, the Court treated them as three 'courses of conduct' rather than calculating each one separately. The Court accepted the agreed penalty because it was large enough to deter Google and others from similar conduct in future, but not so large as to be oppressive. Google Australia didn't have to pay a separate penalty because the fine on Google alone was enough to achieve deterrence. Google also had to implement compliance measures including staff training on consumer law.

Counsel for the Applicant: Ms K Morgan SC with Mr A d'Arville

Solicitor for the Applicant: Norton Rose Fulbright

Counsel for the Respondents: Mr P Brereton SC and Mr R Yezerski

Solicitor for the Respondents: Corrs Chambers Westgarth

BETWEEN: AUSTRALIAN COMPETITION AND CONSUMER COMMISSION Applicant

GOOGLE AUSTRALIA PTY LTD Second Respondent

order made by: THAWLEY J DATE OF ORDER: 12 AUGUST 2022

Scenario 1 Contraventions

Between 30 April 2018 and 19 December 2018, the first respondent engaged in conduct in trade or commerce that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL: (a) in respect of some users in Australia who used an Android OS mobile device (on which Google Mobile Services was installed) to set up a Google Account, and who viewed the "Privacy and Terms" screen and clicked on "More Options", but who did not click on any "Learn more" links, by displaying screens which conveyed representations to the effect that the Location History setting was the setting which controlled whether the first respondent would obtain personal data about the user's location; (b) in respect of some users in Australia who used an Android OS mobile device (on which Google Mobile Services was installed) to set up a Google Account, and who viewed the "Privacy and Terms" screen and also clicked on "More Options" (including those who clicked on the "Learn more" link to the Location History setting but not to the Web & App Activity setting), by displaying screens which conveyed representations to the following effect: (i) with the Web & App Activity setting turned "on" and the Location History setting turned "off", the first respondent would not obtain or use personal data about the user's location at all, even when the user used certain Google Services; or (ii) although the first respondent might obtain and use personal data about the user's location on "one off" occasions to provide a particular Google Service, the first respondent: A. would not retain personal data about the user's location after having so obtained that data; or alternatively B. would not later use the personal data about the user's location which had been so obtained;
By the same conduct and on the same basis as that set out in paragraph 1, the First Respondent: (a) made false or misleading representations in trade or commerce that the Google Services had performance characteristics, uses or benefits which they did not have, in contravention of s 29(1)(g) of the ACL; and (b) engaged in conduct in trade or commerce that was liable to mislead the public as to the nature, characteristics or suitability for purpose of the Google Services, in contravention of s 34 of the ACL. Scenario 2 Contraventions
Between 1 January 2017 and 22 October 2018, in respect of users in Australia who had a Google Account linked to an Android OS mobile device (on which Google Mobile Services was installed), the First Respondent engaged in conduct in trade or commerce that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL by displaying screens which conveyed to some users who had turned the Location History setting from its default position of "off" to "on", and who later used their Android OS mobile device to turn the Location History setting back to "off", representations to the effect that by turning the Location History setting "off", the first respondent: (a) would not be able to obtain, retain or use personal data about their location; or alternatively (b) would continue to be able to obtain and use personal data about their location when they were using a Google Service, but not retain data so obtained or later use that data.
By the same conduct and on the same basis as that set out in paragraph 3, the First Respondent: (a) made false or misleading representations in trade or commerce that the Google Services had performance characteristics, uses or benefits which they did not have, in contravention of s 29(1)(g) of the ACL; and (b) engaged in conduct in trade or commerce that was liable to mislead the public as to the nature, characteristics or suitability for purpose of the Google Services, in contravention of s 34 of the ACL. Scenario 3 Contraventions
Between 9 March 2017 and 29 November 2018, in respect of users in Australia who had a Google Account linked to an Android OS mobile device (on which Google Mobile Services was installed), the first respondent engaged in conduct in trade or commerce that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL by displaying screens which conveyed to some users who were considering whether to turn the Web & App Activity setting "off" (or pause it), and used their Android OS mobile device to navigate to the Web & App Activity landing page, a representation to the effect that having the Web & App Activity setting turned "on" would not allow the first respondent to obtain, retain or use personal data about the user's location.
By the same conduct and on the same basis set out in paragraph 5, the first respondent: (a) made false or misleading representations in trade or commerce that the Google Services had performance characteristics, uses or benefits which they did not have, in contravention of s 29(1)(g) of the ACL; and (b) engaged in conduct in trade or commerce that was liable to mislead the public as to the nature, characteristics or suitability for purpose of the Google Services which the respondents provided in contravention of s 34 of the ACL. The Second Respondent
By adopting and endorsing the conduct of, and representations made by, the first respondent which are the subject of declarations 1 to 6 above, the second respondent: (a) engaged in conduct in trade or commerce that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL; (b) made false or misleading representations in trade or commerce that the Google Services had performance characteristics, uses or benefits which they did not have in contravention of s 29(1)(g) of the ACL; and (c) engaged in conduct in trade or commerce that was liable to mislead the public as to the nature, characteristics or suitability for purpose of the Google Services in contravention of s 34 of the ACL. THE COURT ORDERS THAT:
Pursuant to section 224 of the ACL, the first respondent is to pay to the Commonwealth of Australia a pecuniary penalty of: (a) $10 million in respect of the Scenario 1 Contraventions; (b) $10 million in respect of the Scenario 2 Contraventions; and (c) $40 million in respect of the Scenario 3 Contraventions, being penalties cumulatively totalling $60 million for the said contraventions.
Pursuant to section 246(2)(b) each respondent, at its own expense, is to: (a) within 120 days of the date of the Court's order, review its existing compliance program and make any amendments necessary to ensure that it meets the requirements set out in Annexure A to these Orders; and (b) maintain this program's compliance with the requirements set out in Annexure A to these Orders for 3 years from the date on which these orders are made; and (c) comply with the requirements described in paragraph 6 of Annexure A to these Orders for 3 years from the date on which these orders are made.
The respondents are to pay 50% of the applicant's costs of the proceedings up to and including 16 April 2021 as agreed or assessed noting that the costs of the discovery application filed on 23 July 2021 are the subject of the Court's order of 25 August 2021.
The proceedings otherwise be dismissed. ANNEXURE A Each Respondent will establish or amend, and maintain, Consumer Compliance Measures (Compliance Measures) that comply with each of the following requirements:
Google LLC will, within 120 days of the date of the Court's order, ensure that it has a compliance policy or policies that: (a) contains a statement of commitment to compliance with applicable laws; (b) reflects how commitment to compliance with such laws will be realised within Google LLC; (c) positively encourages all staff to report issues and concerns relating to compliance with applicable laws through designated channels, including describing the steps by which staff may make such reports; (d) prohibits retaliation against any Google employee who raises a concern or participates in an investigation of a possible violation of applicable law and creates a confidential environment for such employees to raise any such concerns without fear of reprisal; and (e) contains a clear statement that failure to follow the compliance policy or policies may result in disciplinary action. Staff Training
Google LLC will ensure that it provides regular (at least once a year) training on applicable consumer laws relating to false, misleading or deceptive conduct for all Product Counsel of Google LLC and GAPL whose duties could result in them being concerned with conduct that may contravene the ACL (Staff Training). Staff Training may be conducted either in-person, via a video communications platform, and/or by relevant employees viewing a pre-recorded video.
Google LLC must ensure that the Staff Training is conducted by a suitably qualified compliance professional or legal practitioner (whether internal or external) with expertise in applicable consumer laws relating to false, misleading or deceptive conduct.
Google LLC will ensure that awareness of applicable consumer laws relating to false, misleading or deceptive conduct forms part of the induction of all new Product Counsel of Google LLC and GAPL whose duties could result in them being concerned with conduct that may contravene the ACL. Confirmation to ACCC
Google LLC will provide a confirmation in writing to the ACCC every 12 months from the date on which these orders are made of whether Google LLC has implemented the Compliance Measures in accordance with these orders. Retention of Compliance Measures documents
Google LLC will maintain a record of copies of compliance policies and training materials utilised in implementing the Compliance Measures for a period not less than 3 years. Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

INTRODUCTION 1 On 16 April 2021, the Court found that Google LLC (Google) contravened each of ss 18, 29(1)(g) and 34 of the Australian Consumer Law (ACL), being Schedule 2 of the Competition and Consumer Act 2010 (Cth) in three ways: Australian Competition and Consumer Commission v Google LLC (No 2) [2021] FCA 367 (Liability Judgment or J). 2 The Court also found that Google Australia Pty Ltd (GAPL) breached the same provisions of the ACL. The Court concluded that it would appear to ordinary and reasonable members of the relevant class that GAPL had adopted and endorsed the conduct and implied representations of Google. 3 In summary, the three contraventions were: (1) First, concerning the representations the subject of the Setup Contraventions: between 30 April 2018 and 19 December 2018, screens about the Location History setting and the consequences of having that setting turned to "off" were shown to some Australian users while they were setting up their Android mobile device. These screens were found to be misleading by the Court because they made implied representations to some users relating to the effect of the Location History setting on Google's collection and use of personal data about the user's location. Personal data is data which is identifiable as being associated with the holder of a particular Google Account and, for the purposes of this proceeding, does not include IP address data - see: J[29]. (2) Secondly, concerning the representations the subject of the LH Contraventions: between 1 January 2017 and 22 October 2018, screens were shown to some Australian users when they turned Location History "off" on their Android mobile device. These are the screens the subject of the "Type A Location History Statements" described at J[241] of the Liability Judgment. These screens were found to be misleading by the Court because they impliedly represented to some users that by turning Location History "off": (a) Google would not be able to obtain, retain or use location data; or (b) Google would continue to be able to obtain and use location data when the user was using a Google product or service, but Google would not be able to retain data so obtained or later use that data - see: J[272]. (3) Thirdly, concerning the representations the subject of the WAA Contraventions: between 9 March 2017 and 29 November 2018, screens were shown to some Australian users when they browsed the options in respect of their Web & App Activity (WAA) setting on their Android mobile device - see: J[309]-[311]. These screens were found to be misleading by the Court because the Court concluded that they impliedly represented to some users that having the WAA setting turned "on" would not allow Google to obtain, retain or use personal data about the user's location - see: J[322]. 4 The question of appropriate penalties was initially in contention between the parties. However, the parties now jointly submit that declarations should be made reflecting the contraventions found by the Court during the liability stage of the trial and that orders should be made that: (a) Google pay pecuniary penalties in the total amount of $60 million; (b) Google and GAPL enter into certain agreed compliance measures; and (c) Google and GAPL pay 50% of the applicant's costs of the liability phase of the proceedings. 5 The parties filed a statement of agreed facts and joint written submissions. Given the agreement of the parties as to the relevant facts, the application of the law to those facts and the appropriate penalty, I will adopt substantial parts of the statement of agreed facts and, where I agree with them, the joint written submissions in providing these reasons.

The penalty provision 6 Section 224(1) of the ACL relevantly provides that, if the Court is satisfied that a person has contravened a relevant provision, the Court may order the person to pay a pecuniary penalty in respect of each act or omission by the person to whom the section applies as the Court determines to be appropriate. Section 224(2) provides: 224 Pecuniary penalties (2) In determining the appropriate pecuniary penalty, the court must have regard to all relevant matters including: (a) the nature and extent of the act or omission and of any loss or damage suffered as a result of the act or omission; and (b) the circumstances in which the act or omission took place; and (c) whether the person has previously been found by a court in proceedings under Chapter 4 or this Part to have engaged in any similar conduct. 7 Section 224(3) sets out the maximum pecuniary penalty payable by a body corporate for each contravening act or omission. Section 224(3) must (now) be read with s 224(3A). 8 Section 224(4) has the effect that a contravenor cannot be penalised twice for the same conduct even though the conduct constituted a contravention of both s 29 and s 34 of the ACL. It provides: (4) If conduct constitutes a contravention of 2 or more provisions referred to in subsection (1)(a): (a) a proceeding may be instituted under this Schedule against a person in relation to the contravention of any one or more of the provisions; but (b) a person is not liable to more than one pecuniary penalty under this section in respect of the same conduct. 9 In Australian Building and Construction Commissioner v Pattinson [2022] HCA 13; 96 ALJR 426 at [9], [10] and [15], the High Court held that the primary, if not sole, object of civil pecuniary penalties is deterrence of contraventions "of a like kind" to the contraventions found by the Court. The plurality stated at [9] that:: Under the civil penalty regime provided by the Act, the purpose of a civil penalty is primarily, if not solely, the promotion of the public interest in compliance with the provisions of the Act by the deterrence of further contraventions of the Act. 10 The maximum penalty is not reserved only for the most serious examples of offending conduct; what is required is that there be "some reasonable relationship between the theoretical maximum and the final penalty imposed": Pattinson at [10], citing Australian Competition and Consumer Commission v Reckitt Benckiser (Australia) Pty Ltd [2016] FCAFC 181, 340 ALR 25 at [156]. The requisite relationship is established where the maximum penalty does not exceed what is reasonably necessary to deter future contraventions of a like kind by the contravenor and by others: at [10]. 11 The object of imposing a penalty is to put a price on contravention that is sufficiently high to deter repetition by the contravenor (specific deterrence) and by others who might be tempted to contravene the statute (general deterrence): at [15]. Retribution, denunciation and rehabilitation have no part to play: at [16]. 12 A civil penalty "must be fixed with a view to ensuring that the penalty is not such as to be regarded by [the] offender or others as an acceptable cost of doing business": at [17], citing Singtel Optus Pty Ltd v Australian Competition and Consumer Commission [2012] FCAFC 20; 287 ALR 249 at [62]. 13 The plurality stated at [40] that (footnotes omitted): Insistence upon the deterrent quality of a penalty should be balanced by insistence that it 'not be so high as to be oppressive'. Plainly, if deterrence is the object, the penalty should not be greater than is necessary to achieve this object; severity beyond that would be oppression. 14 In other words, the penalty should be "proportionate" in the sense that it strikes a reasonable balance between deterrence and oppressive severity: at [41], [46]. 15 At [18], the plurality endorsed the relevant factors identified by French J in Trade Practices Commission v CSR Ltd [1990] FCA 762; (1991) ATPR ¶41-076 at [42], namely: (1) The nature and extent of the contravening conduct. (2) The amount of loss or damage caused. (3) The circumstances in which the conduct took place. (4) The size of the contravening company. (5) The degree of power it has, as evidenced by its market share and ease of entry into the market. (6) The deliberateness of the contravention and the period over which it extended. (7) Whether the contravention arose out of the conduct of senior management or at a lower level. (8) Whether the company has a corporate culture conducive to compliance with the Act, as evidenced by educational programs and disciplinary or other corrective measures in response to an acknowledged contravention. (9) Whether the company has shown a disposition to co‑operate with the authorities responsible for the enforcement of the Act in relation to the contravention. 16 The plurality in Pattinson observed at [19] (footnotes omitted): It may readily be seen that this list of factors includes matters pertaining both to the character of the contravening conduct (such as factors 1 to 3) and to the character of the contravenor (such as factors 4, 5, 8 and 9). It is important, however, not to regard the list of possible relevant considerations as a "rigid catalogue of matters for attention" as if it were a legal checklist. The court's task remains to determine what is an "appropriate" penalty in the circumstances of the particular case. 17 In this context, it should be observed that s 224(2) requires the Court to have regard to any matter which is found to be relevant. Accordingly, the matters in paragraphs (a) to (c) of s 224(2) are not the only mandatory considerations in that any matter which is found to be relevant becomes a mandatory consideration - see: Australian Competition and Consumer Commission v Woolworths Limited [2016] FCA 44;ATPR ¶42-521 at [123] (Edelman J). In Woolworths at [124] and [126], Edelman J described other commonly relevant matters in the following way: [124] Some of the commonly relevant matters other than those in (a) to (c) to which the Court must have regard if relevant were described by Perram J in Australian Competition and Consumer Commission v Singtel Optus Pty Ltd (No 4) [2011] FCA 761; (2011) 282 ALR 246, 250-251 [11] (a list which was referred to without objection on appeal: Singtel Optus Pty Ltd v Australian Competition and Consumer Commission [2012] FCAFC 20; (2012) 287 ALR 249, 258 [37] (the Court)): (1) the size of the contravening company; (2) the deliberateness of the contravention and the period over which it extended; (3) whether the contravention arose out of the conduct of senior management of the contravener or at some lower level; (4) whether the contravener has a corporate culture conducive to compliance with the Act (or the new Australian Competition and Consumer Law) as evidenced by educational programmes and disciplinary or other corrective measures in response to an acknowledged contravention; (5) whether the contravener has shown a disposition to co-operate with the authorities responsible for the enforcement of the Act in relation to the contravention; (6) whether the contravener has engaged in similar conduct in the past; (7) the financial position of the contravener; and (8) whether the contravening conduct was systematic, deliberate or covert. … [126] A consideration of deterrence, general and specific, also means that the following factors will also commonly be relevant: (9) the extent of contrition; (10) whether the contravening company made a profit from the contraventions; (11) the extent of the profit made by the contravening company; and (12) whether the contravening company engaged in the conduct with an intention to profit from it.

Agreements as to penalties 18 In Commonwealth v Director, Fair Work Building Industry Inspectorate [2015] HCA 46; 258 CLR 482 at [57], French CJ, Kiefel, Bell, Nettle and Gordon JJ (with whom Keane J agreed) observed that there is "generally very considerable scope for the parties to agree on the facts and upon consequences" and that there "is also very considerable scope for them to agree upon the appropriate remedy and for the court to be persuaded that it is an appropriate remedy". Their Honours continued at [58]: Subject to the court being sufficiently persuaded of the accuracy of the parties' agreement as to facts and consequences, and that the penalty which the parties propose is an appropriate remedy in the circumstances thus revealed, it is consistent with principle and … highly desirable in practice for the court to accept the parties' proposal and therefore impose the proposed penalty. 19 After referring to these observations in ACCC v Apple Pty Ltd (No 4) [2018] FCA 953 at [6], Lee J described (at [7]), the task of the Court where parties have agreed an appropriate penalty as including two steps: (1) first, the Court forming a view as to whether it is sufficiently persuaded of the accuracy of the parties' agreement as to the relevant facts and consequences; and (2) secondly, the Court determining whether the penalty the parties propose is an appropriate remedy in all the circumstances. 20 In Commonwealth v Director at [46], the High Court noted that there is an important public policy involved in promoting predictability of outcome in civil penalty proceedings, and the practice of receiving and, if appropriate, accepting agreed penalty submissions increases the predictability of outcome for regulators and wrongdoers. The High Court emphasised at [47] that there is a permissible range of appropriate penalties and, at [48], that the court is not bound by the figure suggested by the parties; the Court asks "whether their proposal can be accepted as fixing an appropriate amount". As the parties jointly submitted, the question is whether the penalty is an appropriate penalty, rather than the appropriate penalty. There is no single appropriate penalty, so the correct enquiry is whether the agreed penalty falls within a range which is appropriate having regard to all relevant circumstances: Australian Securities and Investments Commission v Australia and New Zealand Banking Group Limited (No 3) [2020] FCA 1421 at [78] (Allsop CJ).

THE MAXIMUM PENALTY 21 Section 224(3) was amended with effect from 1 September 2018. Before 1 September 2018, the maximum pecuniary penalty for each contravening act or omission engaged in by a corporation was $1.1 million. 22 From 1 September 2018, s 224(3) was amended and subsection (3A) inserted, which provides that the maximum pecuniary penalty payable by a body corporate "for each act or omission that relates to" a provision of Part 3-1 is the greater of: (a) $10,000,000; (b) if the court can determine the value of the benefit obtained directly or indirectly and that is reasonably attributable to the act or omission, three times the value of that benefit; and (c) if the court cannot determine the value of that benefit, 10% of the annual turnover of the body corporate during the 12-month period ending at the end of the month in which the act or omission occurred or started to occur. For the purposes of this calculation, annual turnover does not include the value of supplies that are not connected with Australia - see: ACL s 2. 23 The parties agreed, and I accept, that the value of any benefit obtained by Google that could be reasonably attributable to the contraventions cannot be determined. It follows that s 224(3A)(b) cannot be applied. The revenue connected with Australia of Google LLC and its related bodies corporate ranged from approximately USD 2.1 billion to USD 3 billion per year between the 2017 and 2019 calendar years. It follows that the maximum penalty for reach contravention in this case falls to be determined by reference to annual turnover. 24 The next question is the number of contraventions. The parties do not have the necessary data or information to permit the precise number of contraventions to be calculated. The best estimate, based on the available data, is that the users of 1.3 million Google Accounts in Australia may have viewed a screen that was the subject of the contraventions found by the Court. 25 The ACCC has estimated the following breakdown, in respect of each of the different types of contravention found by the Court: Setup Contraventions: 76,000 LH Contraventions: 57,000 WAA Contraventions: 1,300,000 26 The ACCC's estimates are based on data supplied by Google and certain assumptions based on that data. Google has not disagreed with that estimate. 27 The Court found that in, each scenario, there were users who viewed the relevant screens but would not have read or understood those screens to convey the misrepresentations - see: J[222], J[250], J[255], J[264], J[273] and J[319]-[321]. The parties agreed that the number of users who were misled cannot be ascertained and that this was a relevant matter even if, as the ACCC submitted, there was a contravention each time a user was shown a relevant screen whether or not that user was misled. 28 Given the maximum penalty and the number of times it is estimated that users were shown a contravening screen, the parties submitted that: (a) the arithmetic maximum penalty attaching to Google's conduct would be so disproportionately large as to make precise calculation unnecessary and unhelpful; (b) it was also not helpful to seek to identify and impose differentiated penalties for contraventions before and after 1 September 2018. 29 I agree with this approach.

RELEVANCE OF MULTIPLE CONTRAVENTIONS 30 As noted, the best estimate of the number of Google Accounts that were shown relevant screens is 1.3 million. In Pattinson at [45], the plurality confirmed that certain concepts, familiar in criminal sentencing, may usefully be deployed as analytical tools in the enforcement of civil penalty regimes. These concepts include the course of conduct principle and the totality principle. 31 The course of conduct principle is different to the totality principle, albeit related because the two principles provide different possible solutions to issues which arise in imposing penalties in respect of a multiplicity of contraventions - see: Parker v Australian Building and Construction Commissioner [2019] FCAFC 56; 270 FCR 39 at [274].

Course of conduct 32 Separate contraventions constitute separate acts and attract separate penalties. 33 The application of the course of conduct principle does not convert multiple separate contraventions into a smaller number of contraventions and does not constrain the available maximum penalty - see: Yazaki at [230]-[232]. Rather, the course of conduct principle recognises that, in fixing the fair and reasonable penalty appropriate to achieving the objective of deterrence, it is appropriate in some cases to treat multiple contraventions as being sufficiently closely related as to be appropriately regarded, for the purposes of imposing penalties, as forming part of a "course of conduct". The course of conduct principle only applies where it is desirable to avoid what is properly seen as multiple punishment for those parts of legally distinct offences which may in substance involve the one wrongdoing: Construction, Forestry, Mining and Energy Union v Cahill [2010] FCAFC 39; 269 ALR 1 at [41]; Clean Energy Regulator v MT Solar Pty Ltd [2013] FCA 205 at [75]. Where separate acts are sufficiently interrelated they may be grouped as one "course of conduct" for penalty purposes: Australian Competition and Consumer Commission v Yazaki Corporation [2018] FCAFC 73; 262 FCR 243 at [234]; Australian Competition and Consumer Commission v Coles Supermarkets Australia Pty Ltd [2015] FCA 330; 327 ALR 540 at [82]-[85]. 34 The principle applies only where there is a sufficient relationship between two or more offences: Cahill at [39]. The relationship may be legal, in the sense that it arises from the elements of the contravention, or factual, where circumstances compel the conclusion that the impugned conduct arises out of essentially the same acts, omissions or circumstances or both: Australian Competition and Consumer Commission v Cement Australia Pty Ltd [2017] FCAFC 159; 258 FCR 312 at [422], citing Royer v Western Australia [2009] WASCA 139; 197 A Crim R 319. 35 In the application of the "course of conduct" principle, the parties jointly submitted that it was appropriate for the Court to adopt an approach based on three "courses of conduct", referable to each of the distinct categories of contraventions referred to earlier. I agree with that approach. With the exception of the WAA Contraventions (which involved two 'types' of screens identified as the Type 1 and Type 2 WAA Statements), each category of contravention involved the repeated publication of the same material such that the separate acts within each category may be viewed as inextricably interrelated or as part of the same course of conduct. The contraventions in each of the three categories arose by reason of the underlying design of the relevant screens. The number of contraventions is a function of the number of times the screens were observed by consumers.

Totality 36 The totality principle, as applicable in the civil penalty context and to this case in particular, requires that the total penalty imposed on a person found to have committed multiple contraventions must bear a proper relationship to the overall conduct involved in all of the contraventions after having regard to all of the relevant circumstances and the object for which the penalty is imposed, namely deterrence. 37 The totality principle requires the Court to carry out a "final consideration" or "check" of the penalties to be imposed, to ensure that the aggregate is appropriate and does not "exceed what is proper for the entire contravening conduct involved" - see: Australian Competition and Consumer Commission v EnergyAustralia Pty Ltd [2014] FCA 336; 234 FCR 343 at [101]-[102]. Its application in the context of criminal sentencing was considered by the High Court in Mill v The Queen [1988] HCA 70; 166 CLR 59 at 62-63, where the Court said: The totality principle is a recognized principle of sentencing formulated to assist a court when sentencing an offender for a number of offences. It is described succinctly in Thomas, Principles of Sentencing, 2nd ed (1979), pp 56-57, as follows (omitting references): "The effect of the totality principle is to require a sentencer who has passed a series of sentences, each properly calculated in relation to the offence for which it is imposed and each properly made consecutive in accordance with the principles governing consecutive sentences, to review the aggregate sentence and consider whether the aggregate is "just and appropriate". The principle has been stated many times in various forms: "when a number of offences are being dealt with and specific punishments in respect of them are being totted up to make a total, it is always necessary for the court to take a last look at the total just to see whether it looks wrong["]; "when … cases of multiplicity of offences come before the court, the court must not content itself by doing the arithmetic and passing the sentence which the arithmetic produces. It must look at the totality of the criminal behaviour and ask itself what is the appropriate sentence for all the offences". 38 It necessarily follows from the reasons of the plurality in Pattinson, in particular at [10], [33], [38], [40] and [45], that the totality principle, as applicable in the civil penalty context, is not synonymous with a notion of proportionality concerned with the shaping of the punishment by reference to the statutory maximum penalty. It also follows from the plurality's reasons that the Court should seek to impose a "proportionate" response, where that term is understood to refer to a penalty that strikes a reasonable balance between deterrence and oppressive severity: Pattinson at [41]. The totality principle is a useful analytical tool (Pattinson at [45]) in determining whether a penalty strikes a reasonable balance between deterrence and oppressive severity in circumstances where there is a multiplicity of offences.

Section 224(2)(a): Nature and extent of contravention and any loss or damage suffered 39 The parties jointly submitted that: (1) Where the WAA setting was enabled for a user's Google Account, this meant that personal data in relation to the user's location was retained in a manner such that the data was identifiable in respect of the holder of the relevant Google Account. That retained location data could be used by Google for purposes described in its Privacy Policy, including to provide a more personalised experience across its services such as by tailoring advertisements to users who also had the Ads Personalization setting turned on for their Google Account. Advertising generates revenue for Google. (2) Tailored advertisements can be useful for both advertisers and consumers. As noted at [61] of the Liability Judgment, Google's expert, Professor List, described this as follows: The use of personal data enables Google to offer a variety of personalized services based on individuals' historical locations, travel patterns, web search and browsing activity, etc. Personal data enables Google to tailor advertisements to Users' interests and enables Google to generate higher revenues and better serve advertisers. (3) Location data, including personal data saved by the WAA setting, is sensitive and important to some Australian consumers. 40 In the Liability Judgment, the Court held that, as a result of the contraventions, some Australian users who navigated the screens the subject of the contraventions would not have been aware of Google's retention and use of their personal location data when the Location History setting was turned "off" and the WAA setting was turned "on". Those users were misled and some of them are likely to have made different choices about the collection, storage and use of their location data had the representations not been made. This is a serious matter. The position of the consumers is highly significant. The parties agreed that the number of contraventions is large but that the Court is not assisted by the determination of a precise number of contraventions. The parties properly agreed that location data is sensitive and important to at least some Australian users. It would have been important to at least some of those who were misled. Google retained and used location data in respect of Google Accounts that had the WAA setting turned "on". It did so in circumstances where the Court has found that it had made implied representations to some Australian users which contravened the ACL by being misleading or deceptive.

Section 224(2)(b): Circumstances of the contravention

The Setup Contraventions 41 The class of users relevant to the Setup Contraventions comprised Australian users who: (a) had a mobile device which used the Android operating system and on which Google Mobile Services was installed; (b) were in the process of setting up a Google account on that mobile device; and (c) clicked on the "More Options" link in the screen shown at Annexure A of the Liability Judgment. 42 The screens the subject of the Setup Contraventions were shown during the period between 30 April 2018 and 19 December 2018, including: to all such users between the period 30 April 2018 and 22 October 2018; and to some but not all of those users between 23 October 2018 and 19 December 2018. The Setup Contraventions ceased after 19 December 2018, as a result of updates made by Google.

The LH Contraventions 43 The class of users relevant to the LH Contraventions comprised Australian users who: (a) had a mobile device which used the Android operating system and on which Google Mobile Services was installed; (b) were signed into their Google Account on that mobile device; and (c) wished to turn the Location History setting from "on" to "off". 44 The screens the subject of the LH Contraventions, described as the 'Type A Location History Statements' (J[241]-J[267]), were shown during the period between 1 January 2017 and 22 October 2018, including: to all such users between the period 1 January 2017 and 8 May 2018; and to some but not all of those users between 9 May 2018 and 22 October 2018. From 9 May 2018, some users were shown the 'Type B Location History Statements' (J[278]) instead of the Type A Location History Statements, which were not the subject of the LH Contraventions. The LH Contraventions ceased after 22 October 2018, as a result of updates made by Google.

The WAA Contraventions 45 The class of users relevant to the WAA Contraventions comprised Australian users who: (a) had a mobile device which used the Android operating system and on which Google Mobile Services was installed; and (b) were signed into their Google Account on that mobile device; (c) were considering whether to turn the WAA setting "off" (or pause it); and (d) navigated to the WAA setting landing page. 46 The screens the subject of the WAA Contraventions, described as the 'Type 1 WAA Statements' (J[309]) and 'Type 2 WAA Statements' (J[310]-[311]) were shown during the periods 9 March 2017 to 11 June 2018 and 9 May 2018 to 29 November 2018 respectively. 47 Between 8 October 2018 and 29 November 2018, some but not all users were shown the Type 2 WAA Statements. Other users were shown other updated statements which were not the subject of the WAA Contraventions. The WAA Contraventions ceased after 29 November 2018, as a result of updates made by Google.

Summary 48 In summary, the Setup Contraventions occurred for around 8 months, namely from 30 April 2018 to 19 December 2018. The LH Contraventions extended over about 20 months, from 1 January 2017 to 22 October 2018. The WAA Contraventions extended over about 20 months, from 9 March 2017 to 29 November 2018. 49 On 13 August 2018, an article was published by Associated Press (AP Article) which included matters relating to the conduct. Before the publication of the AP Article, Google had made changes that addressed some but not all of the contravening conduct. Google took further remedial steps after the publication of the AP Article, including changing the screens that were the subject of the contraventions. The steps taken after August 2018 had the result that, by 20 December 2018, Google had addressed all of the contravening conduct, and users were no longer shown the statements that were the subject of the contravening conduct found by the Court. Having said that, Google did not fully identify the contraventions of the ACL which were found by the Court to have occurred. 50 The ACCC does not allege that Google deliberately contravened the ACL.

Section 224(2)(c): previous similar conduct 51 The parties were agreed that there was no previous conduct relevant to the application of s 224(2)(c).

Size and financial position of the contravening company 52 Google is a multinational corporation which earned the following revenue for the calendar years 2017 to 2019 (inclusive): the global revenue of the "Google" segment reported by Google LLC's parent company, Alphabet Inc ranged from approximately USD 110 billion to USD 160 billion per year; and the revenues of Google LLC and its related bodies corporate that were connected to Australia ranged from approximately USD 2.1 billion and USD 3 billion per year. 53 The size of Google's revenue supports a conclusion that a significant penalty is required to achieve the object of general and specific deterrence. It also indicates that the size of the penalty proposed by the parties is not appropriately described as oppressive.

The involvement of senior management 54 The parties were agreed that senior managers of Google were not involved in the contravening conduct.

Corporate culture conducive to compliance 55 The parties jointly submitted that it was relevant to the assessment of penalties that Google: (1) did not fully identify the contraventions of the ACL found by the Court; (2) made changes that addressed all the contravening conduct by 20 December 2018 and no contravening conduct continued thereafter; and (3) has now accepted various compliance measures that will improve its compliance processes in respect of consumer laws, in the form of the consent orders under s 246(2)(b) of the ACL which are now proposed.

Cooperation with authorities 56 Before any proceeding commences, GAPL cooperated with the ACCC by providing certain information voluntarily to the ACCC on behalf of the Google organisation. 57 Google contested liability in these proceedings. It was entitled to do so. 58 Google conducted itself appropriately during the course of the liability phase of the proceedings. It expended significant time and cost in voluntarily preparing several bundles of screenshots and other screens relevant to the liability hearing. This material significantly assisted the Court and the parties in the efficient conduct of the liability hearing and is likely to have narrowed the issues ultimately in dispute. 59 Google's cooperation on the penalties issue has saved the Court the need for a contested hearing. 60 Google has not adduced testimonial evidence of contrition, but it has agreed to orders requiring improved compliance processes. The ACCC accepts that Google's consent to those orders demonstrates a genuine willingness on the part of Google to cooperate with authorities and ensure compliance with all applicable consumer laws. The parties jointly submitted that, by reason of that agreement and Google's approach to the penalty hearing, Google is entitled to a reduction in the penalty which may otherwise have been applicable. The parties submitted that this reduction is reflected in the penalty which has been agreed between the parties. The ACCC would have sought a higher amount had the penalty hearing been contested.

THE POSITION OF GAPL 61 GAPL was not responsible for the preparation of the screens which contained the misleading representations to consumers found by the Court. GAPL's conduct was far more limited than the contraventions of its parent company, Google. GAPL was not found to have directly made the contravening representations itself. Rather, the Court found that it would have appeared to ordinary and reasonable members of the relevant class that GAPL had adopted and endorsed Google's conduct and representations through the sale of Pixel devices on which the Android OS was installed. 62 The parties submitted that deterrence will be achieved in the particular circumstances of this case by Google being ordered to pay the proposed penalty. I am satisfied that an order for Google to pay the penalty will have the relevant specific deterrent effect because the fact of it and its impact would, in substance, permeate Google's operations so far as they are connected to the breaches. Indeed, in this sense, it is preferable for the penalty to fall entirely on Google. The corporate vehicle through which Google chose to implement its conduct is not of particular significance in this case. The imposition of a penalty on Google and not on GAPL is not counter-indicated by considerations of general deterrence given the particular facts of this case. I am therefore satisfied that GAPL need not separately be ordered to pay a pecuniary penalty.

CONCLUSIONS 63 In the absence of agreement on penalty, the task for the Court is to fix a penalty which the Court considers to be appropriate to deter future contraventions of the ACL by Google and others. Where (as here) there is agreement between a regulator and a contravenor, the task is to determine whether the agreed penalty is "an" appropriate penalty in the way earlier described. The parties submit that the following pecuniary penalties are appropriate, reflecting the three courses of conduct referred to earlier: (1) Setup Contraventions: $10 million; (2) LH Contraventions: $10 million; and (3) WAA Contraventions: $40 million. 64 The parties submit that penalties totalling $60 million will strike the right balance between deterrence and oppressive severity when considered in the context of the matters referred to earlier, those factors applying equally to each of the three different courses of conduct. The proposed penalty is higher in respect of the WAA Contraventions because the ACCC's estimate of the number of users of Google Accounts to whom the impliedly misleading representations found by the Court were made is higher. 65 As the parties submitted, although this is not a case where it is suggested that the conduct was deliberate or that the contravenor engaged in a cynical calculation that the benefits of the conduct were likely to outweigh the costs were it to be caught, Google is a company with significant levels of interaction with consumers, such that consumer laws should be front of mind. Further and importantly, many consumers are justifiably and properly concerned about privacy and the storage and use of personal information, including information about their location from time to time. This should be, and presumably is, front of mind to commercial entities which profit from the use of such information. It is not acceptable that consumers be exposed to being misled on these sorts of issues, even by conduct which is not deliberate. 66 As noted earlier, the question is whether the Court considers the penalty is an appropriate penalty in the sense that it falls within an appropriate range. The question is not what penalty the Court would have imposed in the absence of agreement. Absent agreement, there would have been a contested hearing. Having said that, I would have rejected the agreed penalty if I had regarded it as inappropriate in the sense of being outside of an appropriate range. 67 The Court accepts the accuracy of the agreed facts and, generally, the parties' joint submissions as to the effects of the contraventions. The Court is satisfied that the penalty agreed is an appropriate penalty to achieve the necessary specific and general deterrent objective of the imposition of the penalty, when considered together with the declarations and other orders which will be made, including the various compliance measures which the parties have agreed under s 246(2)(b) of the ACL. I certify that the preceding sixty-seven (67) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Thawley.

Outcomeappellant

Disposition:

The Court declared the contraventions of ss 18, 29 and 34 of the ACL by Google LLC and Google Australia Pty Ltd. The Court ordered Google LLC to pay pecuniary penalties totaling $60 million ($10 million for Setup Contraventions, $10 million for LH Contraventions, and $40 million for WAA Contraventions). The Court made orders for compliance measures under s 246(2)(b) of the ACL requiring review of compliance programs, staff training, and record retention for 3 years. The Court ordered the respondents to pay 50% of the applicant's costs of the proceedings up to and including 16 April 2021. No separate penalty was imposed on Google Australia Pty Ltd.

At a glance

Result

Key principles

Issues before the court

Plain English Summary

Judgment (28 paragraphs)

Cited legislation

Parties

Legislation Cited (1)

Cases Cited (21)

Cited By (9)

AI Analysis