The Appropriate Amount of the Penalty
87 The purpose of a civil penalty regime is primarily, if not solely, the promotion of the public interest in compliance with the provisions of the relevant Act by the deterrence, specific and general, of further contraventions: Australian Building and Construction Commission v Pattinson [2022] HCA 13; (2022) 274 CLR 450 at [9], [15] and [31] (Kiefel CJ, Gageler, Keane, Gordon, Steward and Gleeson JJ); Australian Building and Construction Commissioner v Construction, Forestry, Mining and Energy Union [2018] HCA 3; (2018) 262 CLR 157 at [87] (Keane, Nettle and Gordon JJ). The penalty must be fixed with a view to ensuring that the penalty is not such as to be regarded by the offender or others as an acceptable cost of doing business: Australian Competition and Consumer Commission v TPG Internet Pty Ltd [2013] HCA 54; (2013) 250 CLR 640 at [66] (French CJ, Crennan, Bell and Keane JJ); Pattinson at [17]. In other words, those engaged in trade and commerce must be deterred from the cynical calculation involved in weighing up the risk of penalty against the profits to be made from contravention: Singtel Optus Pty Ltd v Australian Competition and Consumer Commission [2012] FCAFC 20; (2012) 287 ALR 249 at [63] (Keane CJ, Finn and Gilmour JJ). However, the penalty should not be greater than is necessary to achieve the object of deterrence, and severity beyond that is oppression: Pattinson at [40].
88 Subject to the particular statutory scheme, retributive justice has no part to play in determining the appropriate civil penalty and the statutory maximum penalty does not implicitly require that contraventions be graded on a scale of increasing seriousness, with the maximum to be reserved exclusively for the worst category of contravening conduct. The statutory discretion is not constrained in this way: Pattinson at [49], [51]. Considerations of deterrence, and the protection of the public interest, may justify the imposition of the maximum penalty where it is apparent that no lesser penalty will be an effective deterrent against further contraventions of a like kind: Pattinson at [50].
89 Although the DJs Cards are no longer sold, American Express continues to operate in the credit card industry and is the subject of DDOs in respect of other cards it issues. That being the case, considerations of specific deterrence are relevant. The DDO regime is consumer-focused and, as with other sections of the Act, is intended to ensure that consumers receive appropriate financial products. Accordingly, general deterrence is an important element in assessing the appropriate penalty. Any penalty needs to be sufficient to deter other product issuers and distributors from contravening the DDO provisions of the Act.
90 The majority in Pattinson considered that the statutory maximum penalty is but one yardstick that ordinarily must be applied, and must be treated as one of a number of relevant factors to inform the assessment of a penalty of appropriate deterrent value: at [53]-[55]. Their Honours rejected an approach by which the statutory maximum penalty was required to be reserved exclusively for the worst category of contravening conduct: at [10] and [49]-[51]. However, their Honours emphasised that there should be "some reasonable relationship between the theoretical maximum and the final penalty imposed", the relationship of reasonableness being established by reference to a need for deterrence having regard to the circumstances of the contravener and the circumstances of the contravention: at [10], [53]-[55].
91 At all relevant times, s 1317G(4) of the Act provided that the maximum penalty for each contravention was the greater of:
(a) $11,100,000 (being 50,000 penalty units);
(b) three times the benefit derived or detriment avoided because of the contravention; and
(c) 10% of annual turnover for the 12-month period ending at the end of the month in which the body corporate contravened, or began to contravene, the civil penalty provision (capped at 2.5m penalty units or $555,000,000).
For the years ended 31 December 2021 and 31 December 2022, American Express reported total revenue of $1,091,200,000 and $1,466,800,000, respectively. The contravention of sub-s 994C(4) occurred from 25 May 2022 to 5 July 2022. For the purpose of the maximum penalty, 10% of annual turnover is $146,680,000 for the year ended 31 December 2022. Accordingly, the maximum penalty for a single contravention is approximately $146 million.
92 Where there is an interrelationship between the factual and legal elements of two or more contraventions, consideration might be given to whether or not it is appropriate to impose a single overall penalty for that course of conduct: Australian Competition and Consumer Commission v Get Qualified Australia Pty Ltd (in liq) (No 3) [2017] FCA 1018 at [36] (Beach J). As Moore, Middleton and Gordon JJ expressed the matter in Construction, Forestry, Mining and Energy Union v Cahill [2010] FCAFC 39; (2010) 269 ALR 1 at [39] (emphasis in original), the course of conduct principle:
recognises that where there is an interrelationship between the legal and factual elements of two or more offences for which an offender has been charged, care must be taken to ensure that the offender is not punished twice for what is essentially the same criminality. That requires careful identification of what is "the same criminality" and that is necessarily a factually specific enquiry. Bare identity of motive for commission of separate offences will seldom suffice to establish the same criminality in separate and distinct offending acts or omissions.
93 As their Honours said in Cahill at [41], however, the principle is only a tool of analysis which can, but need not, be used in any give case in order to ensure an appropriate deterrent effect. As Lee J expressed the point in Australian Competition and Consumer Commission v Equifax Australia Information Services and Solutions Pty Ltd [2018] FCA 1637 at [86], the principle is:
merely a discretionary tool or analytical expedient along the way to determining an appropriate penalty. A precise allocation of the number of courses of conduct is not some sort of calculus which results in various outcomes, depending upon the characterisation of the contravening conduct, as falling into one or other of the identified courses of conduct.
94 The course of conduct principle would have had a significant role to play if I had found contraventions of both s 994C(4) and s 994C(5) to be established. In those circumstances, the parties submitted that the four contraventions should be viewed as involving two courses of conduct: one concerning the DJs Amex Cards and the other concerning the DJs Amex Platinum Card. However, as I have concluded that no contravention of s 994C(5) is established, there are only two courses of conduct, namely the contravention of s 994C(4) in respect of each of the two kinds of card. Agreed Penalty B of $8 million represents a reduction of about 25% from Agreed Penalty A to reflect the fewer number of contraventions while still retaining its deterrent quality.
95 The parties submit that the following penalties for each course of conduct are appropriate:
(a) $4.5 million in respect of the contravention of s 994C(4) regarding the DJs Amex Card; and
(b) $3.5 million in respect of the contravention of s 994C(4) regarding the DJs Amex Platinum Card.
The parties submit, and I accept, that a higher penalty in respect of the contraventions concerning the DJs Amex Card is appropriate having regard to the greater potential for consumer harm associated with the provision of that credit card, given its distribution in greater volumes proportionate to the distribution of the DJs Amex Platinum Card.
96 The totality principle requires the Court to review the "aggregate" penalty to ensure that it is just and appropriate, and not out of proportion to the contravening conduct considered "as a whole" or the "totality of the relevant contravening conduct": Australian Securities and Investments Commission v Westpac Banking Corporation [2019] FCA 2147 at [272] and [308] (Wigney J). It involves a "final overall consideration of the sum of the penalties determined" by consideration of all the relevant factors, and requires the Court to make a final check of the penalties to be imposed on a wrongdoer, considered as a whole: Australian Competition and Consumer Commission v Australian Safeway Stores Pty Ltd [1997] FCA 450; (1997) 145 ALR 36 at 53 (Goldberg J). The totality principle will not necessarily result in a reduction from the penalty that would otherwise be imposed. In cases where the Court considers that the cumulative total of the penalties to be imposed would be too low or too high, the Court should alter the final penalties to ensure that they are just and appropriate: Australian Safeway Stores at 53. The totality principle is distinct from the course of conduct principle in performing a check at the end of the reasoning process.
97 In fixing a pecuniary penalty, the Court will engage in an "intuitive or instinctive synthesis" of all the relevant matters by weighing together all relevant factors, rather than engage in a sequential, mathematical process: Markarian v R [2005] HCA 25; (2005) 228 CLR 357 as applied to civil penalty proceedings in Australian Competition and Consumer Commission v Coles Supermarkets Australia Pty Ltd [2015] FCA 330; (2015) 327 ALR 540 at [6] (Allsop CJ).
98 Section 1317G(6) of the Act mandates a number of factors for the Court's consideration in determining a pecuniary penalty, including relevantly:
(a) the nature and extent of the contravention;
(b) the nature and extent of any loss or damage suffered because of the contravention;
(c) the circumstances in which the contravention took place; and
(d) whether the person has previously been found by a court (including a court in a foreign country) to have engaged in similar conduct.
99 In addition to the need for general and specific deterrence, the factors relevant to the exercise of the Court's determination of an appropriate penalty, as drawn from the authorities, include:
(a) the extent to which the contravention was the result of deliberate or reckless conduct by the corporation, as opposed to negligence or carelessness;
(b) the number of contraventions, the length of the period over which the contraventions occurred, and whether the contraventions comprised isolated conduct or were systematic;
(c) the seniority of officers responsible for the contravention;
(d) the capacity of the defendant to pay, but only in the sense that whilst the size of a corporation does not of itself justify a higher penalty than might otherwise be imposed, it may be relevant in determining the size of the pecuniary penalty that would operate as an effective specific deterrent;
(e) the existence within the corporation of compliance systems, including provisions for and evidence of education and internal enforcement of such systems;
(f) remedial and disciplinary steps taken after the contravention and directed to putting in place a compliance system or improving existing systems and disciplining officers responsible for the contravention;
(g) whether the directors of the corporation were aware of the relevant facts and, if not, what processes were in place at the time or put in place after the contravention to ensure their awareness of such facts in the future;
(h) any change in the composition of the board or senior managers since the contravention;
(i) the degree of the corporation's cooperation with the regulator, including any admission of an actual or attempted contravention;
(j) the impact or consequences of the contravention on the market or innocent third parties;
(k) the extent of any profit or benefit derived as a result of the contravention; and
(l) whether the corporation has been found to have engaged in similar conduct in the past.
See Australian Securities and Investments Commission v Commonwealth Bank of Australia [2020] FCA 790 at [68] (Beach J), and see Pattinson at [18]-[19].
100 That list of factors should not be regarded as a rigid catalogue of matters for attention as if it were a legal checklist; the Court's task remains to determine what is an appropriate penalty in the circumstances of the particular case: Pattinson at [19]. The matters of particular relevance in the present case are as follows.
101 As to the nature and extent of the contravention, the contravening conduct did not occur over a protracted period of time. The contraventions occurred between 25 May 2022 and 5 July 2022, a period of 41 days. This is a matter that mitigates the contravening conduct.
102 As to the knowledge and involvement of senior management, the contravention arose from American Express's failure to implement adequate systems to ensure compliance with the DDO scheme and to equip their staff to understand and act in accordance with the company's obligations under Part 7.8A of the Act. Accordingly, this is not a matter in which senior management were directly involved in a deliberate contravention of the Act. Nonetheless, the Director of the David Jones Alliance was aware of the DDO and the review triggers under the TMDs, and also attended the meetings of the Cancellations Working Group, and was aware of the high cancelled application rates for the DJs Cards. Accordingly, in addition to the overall organisational failures within American Express, it is relevant that the person responsible for the David Jones Alliance also failed to pay attention to the regulatory requirements under the DDO and American Express did not have in place sufficient checks to ensure that it was able to comply with its obligations.
103 As to the nature and extent of any loss or damage suffered because of the contravention, the DDO regime was introduced with the objective of promoting the provision of suitable financial products to consumers. The regime is consumer-focused and intended to sharpen the focus of issuers on the suitability of financial products for consumers, including by requiring identification of the target market.
104 There is no evidence of quantifiable financial loss suffered by consumers as a result of the contravention in this case. However, American Express's conduct was contrary to some of the objectives of the regulatory regime. While American Express took steps to seek to comply with the DDO regime prior to it being introduced, it failed to act in accordance with it in respect of the DJs Cards. American Express's failure arose in circumstances where there were very high cancelled application rates (as high as 60% by the end of the Relevant Period), those cancelled application rates were entrenched despite steps being taken to try to improve them, and the actions taken by American Express to address the cancelled application rates were not working. Further, "attrition" (in the sense of cancelled Card applications) was flagged as an issue of concern prior to the creation of the TMDs and American Express was aware of the reasons for the cancellations of Card applications. High cancellation rates for DJs Cards applied for in a David Jones store could, and ultimately did by 11 May 2022, reasonably suggest that the TMDs were no longer appropriate. If so many customers were cancelling their applications for the DJs Cards, it would not be reasonable to conclude that if the DJs Cards were issued to a retail client in-store in accordance with the distribution conditions, it would be likely that the retail client was in the target market, or if the retail client was in the target market, it would likely be consistent with the likely objectives, financial situation and needs of the retail client.
105 The failure to recognise that the cancelled application rates were a circumstance that reasonably suggested that the TMDs were no longer appropriate meant that no steps were taken to cease issuing the DJs Cards or to review the TMDs until 5 July 2022. Although this circumstance only culminated in May 2022 and persisted for a relatively short period of time, it effectively meant that during this period the DJs Cards were being distributed in circumstances that reasonably suggested inappropriate target market determinations were in place.
106 In the Contravening Period, American Express (SAFA [124]):
(a) received 4,146 in-store applications for the DJs Cards, which comprised 3,634 applications for the DJs Amex Card and 512 applications for the DJs Amex Platinum Card; and
(b) issued 830 DJs Cards (which were applied for in-store), which comprised 689 DJs Amex Cards and 141 DJs Amex Platinum Cards.
107 Accordingly, a large number of consumers continued to apply for the DJs Cards during the Contravening Period even after American Express ought reasonably to have known of the circumstance that reasonably suggested that the TMDs were no longer appropriate. American Express's failure to cease issuing the DJs Cards in-store in the circumstances referred to above exposed some customers to potential harm from obtaining a financial product that may not have been appropriate to all of their needs and objectives: SAFA [128].
108 As to financial gain, the evidence which is the subject of a suppression order under s 37AF of the Federal Court of Australia Act 1976 (Cth) establishes that American Express did not make a significant profit from the contravention. However, the nature and extent of the benefits received by American Express have no bearing on the harm caused to the integrity of the market for financial products (including the potential harm caused to consumers) resulting from a failure to comply with a legislative regime introduced for the purpose of ensuring that financial products are appropriately designed and distributed.
109 As to the size of the contravening company, the size and financial position of American Express are set out at paragraphs [129] to [130] of the SAFA. The company earns substantial revenue from its role as a card issuer, payments acquirer and network operator. Its total revenue in calendar years 2021 and 2022 was between $1 billion and $1.5 billion, although it made net losses in those years of $58.5 million and $5.6 million respectively. In calendar year 2022, its revenue from "fees, spread and other income" was $460 million.
110 Where, as here, the maximum penalty is determined by reference to a company's annual turnover, the legislature has embedded this consideration within the variable maximum penalty. I am therefore mindful of the need to avoid double-counting, by imposing either a greater or lesser penalty based on the financial circumstances of the contravening company in addition to having regard to the maximum penalty for the offence.
111 As to whether the company has a corporate culture conducive to compliance with the Act, American Express's failures relate to the implementation of the TMDs for the DJs Cards, in particular, by way of monitoring the ongoing appropriateness of the TMDs for the DJs Cards, and thus in ensuring ongoing compliance with the DDO regime in respect of the DJs Cards. Nonetheless, American Express undertook the DDO Project and developed the TMDs for the DJs Cards in accordance with its obligations under the Act. Further, American Express created the DDO Product Owner Guide that included information regarding the DDO and the requirements and contents of a TMD and held sessions with Product Owners explaining the design and distribution obligations and the DDO Product Owner Guide: SAFA [90]. Accordingly, during the Relevant Period, American Express demonstrated some level of commitment towards complying with the DDO regime.
112 As to cooperation, contrition and remedial steps, cooperation with authorities in the course of investigations and subsequent proceedings can properly reduce the penalty that would otherwise be imposed. The reduction reflects the fact that such cooperation increases the likelihood of cooperation in future cases in a way that furthers the object of the legislation, frees up the regulator's resources thereby increasing the likelihood that other contraveners will be detected and brought to justice, and facilitates the course of justice: see FWBII at [46].
113 In addition to engaging constructively with ASIC in relation to its voluntary information request, ceasing to offer the DJs Cards on 5 July 2022, and instructing David Jones to cease all in-store distribution of the DJs Cards from 5 July 2022, American Express admitted the contravention prior to the hearing on liability, allowing the hearing to be vacated and cooperated with ASIC in agreeing to the SAFA, which contains admissions contrary to its interests. If anything, American Express went too far in its cooperation with ASIC, by admitting contraventions of s 994C(4) and (5) on the basis of an untenable construction of para (c)(ii) in each of those provisions, as discussed above. Its cooperation also extended to providing ASIC with additional material to allow further facts to be included in the SAFA: SAFA [132].
114 Prior to the Contravening Period, since April 2022, American Express has undertaken work to update its DDO program, including (SAFA [133]):
(a) publishing a dedicated DDO Review Trigger Policy, which establishes clear processes for the enhanced monitoring of relevant data points, clear escalation protocols and decision ownership for identifying review triggers and conducting a review of the TMD, identifying key stakeholders and decision makers. American Express's internal audits are conducted against this policy;
(b) establishing a dedicated monthly DDO Forum which is attended by Product Owners and other key stakeholders and which reviews specific product metrics, distribution channels and other product related matters. The DDO Forum specifically considers potential review triggers, in accordance with the American Express DDO Review Trigger Policy. Product Owners are also required to prepare the metrics related to their product, and present those metrics at the DDO Forum and stakeholders are given the opportunity to discuss those metrics. DDO metrics are also presented quarterly at the Compliance Committee;
(c) establishing a dedicated Complaints Forum which includes consideration of complaint categories and products for DDO compliance;
(d) completing a comprehensive review and update of all existing TMDs, including the revision of relevant Critical Assessment Questionnaires; and
(e) conducting new, company-wide training on DDO and targeted product owner training, to ensure DDO competency within all relevant teams.
These remedial measures, as well as American Express's admissions, are evidence of contrition in respect of the contraventions and are mitigating factors.
115 As to any prior contraventions of the Act, American Express has not previously been found to have contravened any relevant laws: SAFA [131].