The competition watchdog has sounded the alarm over companies that are hoovering up data and selling it on for other services, with Australians largely unaware of such data brokerages and the widespread risks associated with them.

The Australian Competition and Consumer Commission (ACCC) this week released its eighth report as part of its ongoing Digital Platform Services Inquiry, focusing on data products and services.

The report offers insight into the often opaque world of data firms and their practices, which it defines as “data collection, storage, supply, processing and analysis services by firms that do not generally have a direct relationship with the consumer or individual the data is collected from”.

The ACCC has raised concerns with long and “ambiguous” privacy policies that give users no choice but to accept the widespread sharing of their data, and the range of potential harms when this data is passed onto other firms to be used for different purposes than it was collected for.

“In many cases, the data firms do not have a direct relationship with the consumers whose data may be used,” ACCC deputy chair Catriona Lowe said.

“Data is a critical commodity in today’s economy as it helps businesses create innovative products and tailor new services for consumers.”

Opaque privacy policies

The ACCC report found that the average privacy policy is 6,876 words long and would take someone 29 minutes to read.

If someone was to actually read all the privacy policies they are presented with in a month, it would take them 46 hours, the report found.

Lowe said this means Australians do not have proper visibility over how their data is being used and who it is being given to.

“Many consumers may be unaware of the scope of data that is collected and then shared or on-sold to other data firms or unidentified third parties,” she said.

“As consumers are increasingly required to provide personal information or other data on themselves to access important services, such as applying for a rental property or receiving any insurance quote, we are very concerned that consumers may be unable to exercise choice of meaningful control over how their data is shared and used.”

The data held by these companies can include an individual’s living condition, income, biometric data, criminal and medical history, unique identifiers for online activities, and what content they consume online.

This data is often used in de-identified form, but the ACCC report raises concerns about the growing risk of data like this being re-identified after it is linked with other publicly available datasets.

The competition watchdog is also worried about the potential for the targeting of individuals through splitting people into segments based on data, such as the targeting of gambling ads to someone who is addicted to gambling products.

The rise of GenAI

The competition watchdog is especially concerned with the growing popularity of generative artificial intelligence tools and the increased value this has placed on data.

The report found that generative AI tools rely on being trained with enormous amounts of data, but it’s often unclear at best whether consent has been given for this use.

“Generative AI products and services present new opportunities for business customers, which can use these data analysis technologies to efficiently process large volumes of data and develop and supply new products and services,” the report said.

“Trust in these technologies may be undermined if consumers do not understand or cannot control how an organisation uses their information.

The ACCC did not make any new recommendations in its latest report but used it to back up previous recommendations around Privacy Act reforms to give individuals more control over their own data.