Last week’s Federal Court decision in ACCC v Uber highlights the risks associated with taking a ‘set and forget’ approach to regulatory compliance, particularly when relying on automated processes, and serves as a reminder of the Federal Court’s willingness to intervene over agreed penalties for contraventions of the Australian Consumer Law (ACL).
In April 2022 the ACCC commenced proceedings against Uber B.V. (Uber) for misleading and deceptive conduct and false and misleading claims in relation to Uber displaying:
These representations were generated from Uber’s automated systems and in some cases were generated and controlled by other Uber entities. As a result of their automation, they were displayed to a very large number of consumers over a prolonged period of time.
Uber and the ACCC filed a statement of agreed facts and admissions, and proposed orders to resolve the matter for a penalty of $26 million. Despite the agreement between the parties, the Court considered the proposed penalty “outside the range” of appropriate penalties in the circumstances and described the evidence adduced in support of the proposed sum as “grossly inadequate”[1]. At that time the Court considered a penalty in the order of $4-6 million would be more appropriate, and invited the parties to provide further evidence in support of the penalties they were seeking.
Despite the Court finding that the parties’ further submissions failed to “adequately explain how the [penalty] figures had been arrived at” and a lack of discernible harm caused to consumers, due to the scale of the contravening conduct the Court ultimately ordered that Uber pay $21 million in penalties and contribute $200,000 to the ACCC’s costs.
The Court observed that there were a “very large” number of contraventions over a “lengthy period of time” resulting from:
The Court also found that, although the conduct caused only “modest loss or damage to consumers” and was largely the result of automated messaging, this did not absolve Uber of liability. In fact, the Court found that Uber had failed “to take steps to ensure the cancellation messaging was accurate and not misleading” and that this was “an important circumstance in determining the penalty” in the amount ordered.
This case is a reminder that going to market with information generated from automated systems or third-party sources without adequate monitoring may risk:
This decision also highlights the Court’s willingness to intervene where parties have agreed penalties, especially where the Court considers that neither party has provided sufficient evidence in support of the agreed outcome.
Taking a ‘wait and see’ or ‘set and forget’ approach to automated procedures, or automatically generated information risks far reaching and long-running regulatory non-compliance going unchecked. It is important to ensure systems are in place to actively monitor and audit the accuracy of any representations made to consumers (or the market), especially when based on information derived from automated systems or third-party sources. This is even the case where it appears unlikely that the conduct will result in significant or any consumer harm.
Automation is not a defence to ACL contraventions and will not protect companies from significant penalties. To avoid inadvertently breaching the ACL (or other applicable laws and regulations), it is important to maintain ACL (or other applicable) risk monitoring, compliance and training programs that are up-to-date and fit for purpose.
It is critical for organisations to maintain a good understanding of the ACL and wider regulatory compliance obligations so they can identify and address business activities that pose a compliance risk generally, and those that are capable of attracting potentially unlimited penalties.
In addition to financial penalties, failing to comply with obligations also risks reputational damage, given the publicity that usually accompanies ACCC proceedings.
This decision highlights the need to be adaptive and thorough in your engagement with a regulator. It is likely that as a result of the Court’s criticism over the adequacy of information provided, and the lack of evidence of real consumer harm, the ACCC will require more comprehensive and complete supporting documentation. This is likely to have a material impact on negotiations, and any Court review of the penalties which are agreed.
It is also important to remember that any supporting materials provided to the ACCC in penalty negotiations may become public. So, before handing over documents it is wise to engage with your legal advisors, the regulator and the Court on matters of privacy and confidentiality, to ensure sensitive information is not inadvertently disclosed.
It is also worth noting, that while class action may be unlikely in this case, the risk of such proceedings must be considered when providing evidence to a regulator or putting it forward in any initial proceedings.
[1] ACCC v Uber [11].
[2] ACCC v Uber [124].
[3] ACCC v Uber [82]-[83] and [123].
The Treasurer yesterday announced far-reaching reforms of Australia's merger control regime. The reforms proposed by the Government include the introduction of a mandatory notification requirement...
Late last week, the Chair of the ACCC announced the regulator's compliance and enforcement priorities for 2024-2025.
2024 is off to brisk start in the cyber, privacy and data space – regulatory developments in cyber security and artificial intelligence (AI) continue at pace.