The Journey Criterion Breaches
36 One of the policies available under the Integrated Product was what was called a "Plan D" policy. The PDS in relation to this policy provided that, in order for a customer to have insurance coverage under the policy, the travel in question was required to commence in Australia (the Journey Criterion). From 19 May 2017 this criterion changed to include travel commencing or concluding in Australia.
37 In booking and purchasing products through the Expedia websites, customers were required to enter the place from which their journey would commence, and the place at which their journey would conclude. Notwithstanding the provision of this information as part of the purchasing process on the Expedia websites, no control mechanism existed to ensure that only customers whose travel satisfied the Journey Criterion would be permitted to purchase the Plan D policy. As a consequence, between 24 February 2015 and 12 September 2018, 64,911 Plan D policies were purchased by customers who did not satisfy the Journey Criterion and where thereby excluded from coverage. Of those 64, 911 customers, 1,149 customers who did not satisfy the Journey Criterion made a claim under the policy, and of those customers, 16 claims were denied wholly on the basis of the Journey Criterion.
38 The purchase path by which customers who did not satisfy the Journey Criterion were able to acquire the Plan D policy was submitted - in the form of a screenshot - by AWP to Allianz for its approval. Allianz approved the relevant purchase path. Intermittently between (and indeed prior to) the approval of the path in November 2014, and September 2018, Allianz, AWP and Expedia communicated regarding the fact that customers were able to purchase Plan D policies without satisfying the Journey Criterion. Despite the compliance issue being first identified on 16 April 2010 by an Expedia employee, only on 11 September 2018 (some eight years later) did the defendants take steps to ensure that the offering was suspending in light of the compliance issue.
39 In respect of the Journey Criterion breaches, Allianz made admissions as follows:
(a) Between 24 February 2015 and 12 September 2018, Allianz, in trade or commerce, engaged in conduct in relation to financial services that was misleading or deceptive or likely to mislead or deceive and thereby contravened s 12DA of the ASIC Act and s 1041H of the Corporations Act, in that:
(i) it was a requirement for cover under the Plan D policy that a customer's travel satisfy the Journey Criterion;
(ii) customers were required to enter places of origin and conclusion of their travel during the purchase process on the Expedia websites from which the Plan D policy was available for purchase;
(iii) Allianz failed to take reasonable steps to ensure that the Expedia websites contained a control mechanism to prevent customers who did not satisfy the Journey Criterion requirement from purchasing the Plan D policy; and
(iv) 64,911 customers who did not satisfy the Journey Criterion purchased the Plan D policy through the Expedia websites.
40 In respect of the Journey Criterion breaches, AWP made the following admissions:
(a) Between 24 February 2015 and 12 September 2018, AWP in trade or commerce engaged in conduct in relation to financial services that was liable to mislead the public as to the characteristics or the suitability for their purposes of financial services and thereby contravened s 12DF of the ASIC Act, in that:
(i) it was a requirement for cover under the Plan D policy that a customer's travel satisfy the Journey Criterion;
(ii) customers were required to enter places of origin and conclusion of their travel during the purchase process on the Expedia websites from which the Plan D policy was available for purchase;
(iii) AWP failed to take reasonable steps to Ensure the Expedia websites contained a control mechanism to prevent customers who did not satisfy the Journey Criterion requirement from purchasing the Plan D policy; and
(iv) 64,911 customers who did not satisfy the Journey Criterion purchased the Plan D policy through the Expedia Websites.
41 In making recommendations as to the appropriate penalty to be imposed with respect to the Journey Criterion Breaches, ASIC raised six matters of relevance.
42 First, ASIC submitted that the evidence demonstrated that AWP had knowledge of the shortfalls of the Expedia system which allowed ineligible customers to purchase insurance. It was submitted that AWP was in possession of this knowledge for a significant period of time, yet failed to redress the issue.
43 Secondly, ASIC submitted that almost 65,000 ineligible customers purchased insurance.
44 Thirdly, ASIC submitted that a number (albeit a small number) of customers were denied coverage under their policies by reason of their failure to satisfy the Journey Criterion.
45 Fourthly, ASIC drew an analogy with two cases: Australian Competition and Consumer Commission v Telstra Corporation Limited [2018] FCA 571; and Australian Competition and Consumer Commission v Optus Mobile Pty Limited [2019] FCA 106. In those cases, penalties of $10 million were imposed against each of Telstra and Optus, wherein the contraventions involved large numbers of customers (one million Optus customers were exposed to the misleading representations each year, while the number of Telstra customers was unknown, potentially being in excess of 100,000 customers per year). ASIC conceded that the number of customers affected in these proceedings was lower, with only a small number being denied coverage under the policy. ASIC therefore submitted that these comparisons were above the appropriate range in the present case.
46 Fifthly, ASIC submitted that there was a significant number of contraventions, insofar as each occasion on which an ineligible customer purchased a policy, it constituted a separate contravention.
47 Sixthly, ASIC submitted that it was not possible to evaluate the potential or actual loss to customers, although it is pertinent to note that some customers had their insurance coverage denied by reason of the Journey Criterion. Here, it was submitted that the breaches involved various levels of Allianz and AWP management, albeit with senior management becoming involved only subsequent to the compliance issue becoming apparent. Correspondence between AWP and Expedia, it was submitted, demonstrated AWP's knowledge of the issue. It follows, on this submission, that AWP was culpable in not requiring its rectification.
48 With respect to Allianz's involvement in the Journey Criterion Breaches, ASIC recommended (and Allianz did not oppose) declarations of contravention of s 12DA of the ASIC Act, and s 912A(1)(a) and (c), and s 1041H of the Corporations Act. With respect to AWP's involvement in the Journey Criterion Breaches, ASIC recommended (and AWP did not oppose) declarations of contravention of s 12DF of the ASIC Act, and s 912A(1)(a) and (c) of the Corporations Act, in addition to a pecuniary penalty of $900,000. The disparity between the remedial response imposed on Allianz and on AWP was said to result from there being no indication, upon the available evidence, that Allianz was aware of the flaws in the system prior to the emergence of the compliance issue.