FEDERAL COURT OF AUSTRALIA

Australian Competition and Consumer Commission v HealthEngine Pty Ltd [2020] FCA 1203

ORDERS

THE COURT DECLARES THAT:

1.    During the period 31 March 2015 to 1 March 2018, the Respondent (HealthEngine), in trade or commerce, in connection with the supply or possible supply of services, by publishing feedback received from Patients (Patient Reviews) on HealthEngine's website at www.healthengine.com.au or mobile phone app (together, the Platforms) in circumstances where HealthEngine:

(a)    implemented a practice of not publishing negative Patient Reviews, and editing Patient feedback before it was published (as set out in the Revised Schedule of Review Conduct filed 12 December 2019 (Schedule of Review Conduct)); and

(b)    failed to disclose to consumers on its Platforms that it engaged in that practice,

(the Review Conduct), represented that the Patient Reviews published on the Platforms in connection with health practices and practitioners across Australia (Health Practices) were an accurate reflection of the Patient Reviews HealthEngine received from Patients about the Health Practices (the genuine reviews representations), when they were not, and thereby:

(c)    engaged in conduct that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) (ACL); and

(d)    made false or misleading representations that the services provided by HealthEngine on the Platforms were of a particular standard, quality, value or grade, in contravention of s 29(1)(b) of the ACL.

2.    During the period 31 March 2015 to 1 March 2018, HealthEngine, in trade or commerce, in connection with the supply or possible supply of services, by:

(a)    using Patients' responses to a question designed to ascertain whether the Patient would recommend the Health Practice to others (the Ratings Question) to calculate a practice rating for particular Health Practices who chose to participate (the Participating Health Practices); and

(b)    failing to disclose to consumers on its Platforms that, where less than 80% of Patients answered 'yes' to the Ratings Question in relation to a Participating Health Practice, instead of publishing a rating, it would publish a notation indicating that the Participating Health Practice had no rating and display a statement to the effect that there was insufficient data to calculate a patient satisfaction level or that the practice did not have a customer satisfaction score; and

(c)    where less than 80% of Patients answered 'yes' to the Ratings Question in relation to a Participating Health Practice, publishing on the Platforms a notation indicating that the Participating Health Practice had no rating and displaying a statement to the effect that there was insufficient data to calculate a patient satisfaction level or that the practice did not have a customer satisfaction score,

(the Ratings Conduct),

represented to consumers that it had not received sufficient feedback (either positive or negative) from Patients to enable HealthEngine to calculate and publish on the Platforms a practice rating for the relevant Participating Health Practices (the insufficient feedback representations), when in fact HealthEngine:

(d)    had received sufficient feedback; and

(e)    was able to publish a practice rating, but chose not to,

    and thereby:

(f)    engaged in conduct that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL; and

(g)    made false or misleading representations that the services provided by HealthEngine on the Platforms were of a particular standard, quality, value or grade, in contravention of s 29(1)(b) of the ACL.

3.    During the period 31 March 2015 to 1 March 2018, HealthEngine, in trade or commerce, in connection with the supply or possible supply of services, by engaging in the Review Conduct and the Ratings Conduct, engaged in conduct that was likely to create a more positive or favourable impression on consumers who used the Platforms to find a suitable Health Practice, and thereby engaged in conduct that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL.

4.    During the period 31 March 2015 to 1 March 2018, HealthEngine, in trade or commerce, in connection with the supply or possible supply of services, by publishing Patient Reviews on the Platforms which had been edited to remove negative comments and/or suggestions for improvement, or to embellish them so that they appeared more positive (as set out in the Schedule of Review Conduct), HealthEngine, on each occasion it published such a Patient Review:

(a)    engaged in conduct that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL; and

(b)    made a false or misleading representation that purported to be a testimonial by Patients relating to services provided by Health Practices (the misleading testimonial representations), in contravention of s 29(1)(e) of the ACL.

5.    In the period from 30 April 2014 to 30 June 2018, HealthEngine, in trade or commerce, in connection with the supply or possible supply of services, by:

(a)    collecting non-clinical personal information (Personal Information) from Patients who used the Platforms or a booking widget embedded on the website of some Health Practices;

(b)    asking the Patient whether they wished to receive a call in relation to health insurance comparison services, or to assist the Patient to assess their private health insurance needs (the Health Insurance-Related Services);

(c)    not making it adequately clear on the online booking form that if the Patient answered 'yes', their Personal Information would be sent to one of nine different private health insurance brokers (the Insurance Brokers); and

(d)    providing Patients' Personal Information to one of the Insurance Brokers,

engaged in conduct that was liable or likely to cause Patients to believe that HealthEngine would provide the Health Insurance-Related Services when it did not, and in fact provided the Personal Information to a third party (the Referral Conduct), and thereby:

(e)    engaged in conduct that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL; and

(f)    engaged in conduct that was liable to mislead the public as to the nature, characteristics and/or suitability for their purpose of services provided by HealthEngine, in contravention of s 34 of the ACL.

THE COURT ORDERS THAT:

Pecuniary Penalties

6.    Pursuant to s 224(1)(a)(ii) of the ACL, HealthEngine pay to the Commonwealth of Australia a pecuniary penalty in the amount of $2,900,000, in respect of HealthEngine's contraventions of sections 29 and 34 of the ACL, identified in declarations 1, 2, and 5 above, in the following instalments:

(a)    the amount of $750,000, within 6 months of the date this order is made by the Court;

(b)    the amount of $750,000, within one year of the date this order is made by the Court;

(c)    the amount of $700,000, within 18 months of the date this order is made by the Court; and

(d)    the amount of $700,000, within 24 months of the date this order is made by the Court.

Non-punitive Orders

Review of Compliance Program

7.    Pursuant to s 246(2)(b) of the ACL, HealthEngine:

(a)    at its own expense and for a period of three years, arrange for an annual review of its existing ACL compliance program to be undertaken, which review is to have particular regard to the declarations made in these proceedings;

(b)    ensure that each review is carried out by a suitably qualified, independent compliance professional with expertise in competition and consumer law (the Reviewer). The Reviewer will qualify as independent on the basis that he or she:

(i)    did not design or implement HealthEngine's existing ACL compliance program;

(ii)    is not a present or past staff member or director of HealthEngine;

(iii)    has not acted and does not act for, and has not consulted and does not consult to, HealthEngine in any competition or consumer law related matters, other than performing reviews pursuant to this Order; and

(iv)    has no significant shareholding or other interests in HealthEngine.

(c)    ensure that a review by the Reviewer is completed within one year of the date of this order coming into effect, and that a subsequent review is completed within each year for three years in total; and

(d)    within one month after the date that each review in order 7(a) is completed, implement any changes identified as necessary by the Reviewer during that review, and write to the Applicant to identify these changes and confirm they have been made.

Contacting affected consumers

8.    Pursuant to s 246(2)(c) of the ACL, within 28 days after the date this order is made by the Court, HealthEngine contact by email in the form set out in Annexure A to these orders , all Patients whose Personal Information was provided to an Insurance Broker during the period from 30 April 2014 to 30 June 2018, with the communication to include the following information:

(a)    that their Personal Information was provided to an Insurance Broker which may have included some or all of the following: the Patient's name, phone number, email address, date or year of birth, appointment time, type of health care practice the Patient had made a booking with (e.g. GP, chiropractic or dentistry), and/or whether or not the Patient had private health insurance (and if so, the provider);

(b)    the identity of each Insurance Broker to whom that Patient's Personal Information was provided;

(c)    the nature of the Referral Conduct, and that the Court has found the Referral Conduct to be in breach of the ACL (in the terms described in the declarations made in declaration 5 above); and

(d)    instructions as to how the Patient can request that their Personal Information be deleted.

Costs

9.    HealthEngine pay to the Commonwealth of Australia the Applicant's costs of, and incidental to, this proceeding fixed in the amount of $50,000.00, within 7 days after the date this order is made by the Court.

Annexure A - Notification to Consumers

IMPORTANT: Notice about personal (non-health) information you provided to HealthEngine

Hi [insert name]

I am writing to you about a HealthEngine service you used sometime between 30 April 2014 and 30 June 2018. During this period, you filled-out an online form providing personal information - but not clinical information - and requested a call about your private health insurance needs or to access health insurance comparison services.

What happened?

We did not adequately make clear, at the time you completed the online form, that someone other than HealthEngine would make this call, and that we would pass on your personal information to an external private health insurance broker. We would like to apologise for this and advise how you can ask them to delete your personal information.

Information that was shared

When you requested a call for health insurance comparison services, HealthEngine provided [insert insurance broker name] with your personal information, which may have included some or all of the following: your name; phone number, email address; date or year of birth; appointment time; type of health care practice at which you made a booking (e.g. GP, chiropractic or dentistry), and/or whether you had health insurance (and if so, the provider).

No clinical information was shared with third parties and the information was used only to assist in fulfilling your request for a discussion of your private health insurance coverage.

ACCC action

In action commenced by the ACCC, we accepted that by providing your personal information to [insert insurance broker] without clearly communicating on the booking form that we would do so, we engaged in conduct that was liable or likely to cause patients to believe that HealthEngine would provide the health insurance comparison, when in fact, the relevant broker would provide those services. By engaging in this conduct, HealthEngine breached the Australian Consumer Law. This was accepted by the Federal Court.

How to delete your personal information held by HealthEngine

If you would like HealthEngine to delete your personal information, there are two ways this can be done. You can either send us a request in writing to: Privacy Officer, HealthEngine Pty Limited, PO Box 7754, Cloisters Square, WA 6850, Australia; or by emailing us at privacyofficer@healthengine.com.au.

How to delete your personal information held by [insert insurance broker]

If you would like [insert insurance broker] to delete your personal information that was provided to them by us (as opposed to any information you may have directly provided to them, or as part of other dealings you have had with them), there are two ways this can be done. You can either send us a request in writing to: Privacy Officer, HealthEngine Pty Limited, PO Box 7754, Cloisters Square, WA 6850, Australia; or by emailing us at privacyofficer@healthengine.com.au, and we will forward that request to [insert insurance broker]. Alternatively, you can send a request in writing directly to [insert insurance broker]: [insert details provided by insurance broker].

HealthEngine is confident information was only shared where a user had expressly requested to be contacted. To be clear, HealthEngine does not sell user databases to third parties.

We set ourselves high standards for the services we provide, and in this instance, we have not met those standards, and we apologise for that.

HealthEngine takes our responsibility to our users seriously. Your trust is paramount to me and my team, and we are working hard to keep your trust.

Yours sincerely

Dr Marcus Tan

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

YATES J

INTRODUCTION

1    HealthEngine operates Australia’s largest online health marketplace. It conducts a business, in trade or commerce, of hosting an online directory listing over 70,000 health practices and practitioners across Australia (Health Practices), and facilitating bookings by consumers (Patients) for services provided by those Health Practices.

2    HealthEngine conducts its business primarily through its website (http://www.healthengine.com.au) and mobile phone app (together, the Platforms). Through its Platforms, HealthEngine provides access to the online directory and an online booking system that enables Patients to book consultations with Health Practices. At times relevant to this proceeding, HealthEngine also published reviews and ratings to enable Patients to identify Health Practices.

3    The applicant, the Australian Competition and Consumer Commission (the Commission), alleges that, in the course of carrying out its business, HealthEngine engaged in conduct in contravention of ss 18, 29(1)(b), 29(1)(e) and 34 of the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) (the ACL). HealthEngine admits that it contravened the ACL to the extent articulated in orders agreed between the parties. In its Concise Statement filed in respect of its originating application commencing this proceeding, the Commission alleged other contraventions. The Commission no longer presses its claims in that regard.

4    The parties have reached agreement as to the orders which they say the Court should make, including as to the imposition of a pecuniary penalty. The proceeding is now before the Court to assess the appropriateness of those orders and, if appropriate, to make them or, if not appropriate, to make other orders which will dispose of the Commission’s claims.

5    The parties recognise that the granting of relief in respect of the admitted contraventions remains within the discretion of the Court. The parties also recognise that contraventions of this kind are serious because of their immediate potential to mislead consumers of medical services about non-medical or non-clinical aspects of Health Practices.

6    To assess the Court’s consideration of the appropriateness of the agreed orders, including the appropriateness of the pecuniary penalty to be imposed, the parties have filed:

(a)    a Statement of Agreed Facts and Admissions (Exhibit A);

(b)    a Revised Schedule of Review Conduct (Exhibit B); and

(c)    a Supplementary Statement of Agreed Facts and Admissions (Confidential Exhibit C).

7    The Supplementary Statement of Agreed Facts and Admissions was filed after the commencement of the hearing of this proceeding on 5 June 2020 to address some concerns I expressed at that time as to the sufficiency and completeness of the information placed before the Court to enable it to consider the appropriateness of the agreed orders. The Supplementary Statement of Agreed Facts and Admissions contains information, including financial information, which is confidential to HealthEngine but which has, nonetheless, been disclosed to the Court, and to the parties and their legal advisers. I am satisfied that it is appropriate to prevent the further disclosure of this information and have made an order pursuant to ss 37AF and 37AG(1)(a) of the Federal Court of Australia Act 1976 (Cth). I have required the parties to file a redacted version of the Supplementary Statement of Agreed Facts and Admissions, the disclosure of which is not limited (Redacted Exhibit C).

8    It is important to note that the Statement of Agreed Facts and Admissions and the Supplementary Statement of Agreed Facts and Admissions contain “agreed facts” within the meaning of s 191 of the Evidence Act 1995 (Cth). These are facts that are not to be disputed for the purpose of this proceeding. These documents now provide the evidential basis on which the Court will consider the appropriateness of the agreed orders.

9    The parties have also filed Joint Submissions on Contraventions and Relief and Supplementary Joint Submissions on Contraventions and Relief. The latter submissions address, principally, the further facts and admissions put before the Court through the Supplementary Statement of Agreed Facts and Admissions. The two sets of submissions explain why the parties contend that the agreed orders are appropriate and why the Court should proceed to make orders in that form. At the adjourned hearing on 10 August 2020, the parties supplemented their written submissions with short oral submissions.

10    The approach that the Court takes in a civil penalty proceeding (such as this proceeding) when the parties present an agreed outcome to the Court for its consideration is explained in The Commonwealth of Australia v Director, Fair Work Building Industry Inspectorate [2015] HCA 46; 258 CLR 482.

11    In that case, the plurality (French CJ, Kiefel, Bell, Nettle and Gordon JJ) observed (at [46]) that:

… there is an important public policy involved in promoting predictability of outcome in civil penalty proceedings and that the practice of receiving and, if appropriate, accepting agreed penalty submissions increases the predictability of outcome for regulators and wrongdoers. As was recognised in Trade Practices Commission v Allied Mills Industries Pty Ltd [No 5] (Allied Mills) and authoritatively determined in NW Frozen Foods Pty Ltd v Australian Competition and Consumer Commission (1996) 71 FCR 285, such predictability of outcome encourages corporations to acknowledge contraventions, which, in turn, assists in avoiding lengthy and complex litigation and thus tends to free the courts to deal with other matters and to free investigating officers to turn to other areas of investigation that await their attention.

12    The plurality also observed (at [58]) that:

… Subject to the court being sufficiently persuaded of the accuracy of the parties’ agreement as to facts and consequences, and that the penalty which the parties propose is an appropriate remedy in the circumstances thus revealed, it is consistent with principle and, for the reasons identified in Allied Mills …, highly desirable in practice for the Court to accept the parties’ proposal and therefore impose the proposed penalty. To do so is no different in principle or practice from approving an infant’s compromise, custody or property compromise, a group proceeding settlement or a scheme of arrangement.

(Emphasis in original.)

13    The plurality noted further (at [60]) that, in such proceedings, the regulator (here, the Commission) is not a disinterested party. The plurality said that it is to be assumed that the regulator will fashion penalty submissions with an overall view to achieving the objective of monitoring and promoting appropriate standards. This supports the propriety of a court receiving joint submissions as to facts and penalty and imposing the proposed penalty if persuaded that it is appropriate. It is the function of the relevant regulator to regulate the industry in order to achieve compliance and, accordingly, it is to be expected that the regulator will offer informed submissions as to the effects of the contraventions in question and the level of penalty necessary to achieve compliance. That said, the plurality also made clear (at [61]) that the submissions of a regulator will be considered on their merits in the same way as the submissions of a respondent, subject to them being supported by findings of fact based upon evidence, agreement or concession.

THE CONDUCT

14    The Statement of Agreed Facts and Admissions establishes the contraventions that are now pressed. For the reasons advanced in [61] – [63] of the Joint Submissions on Contraventions and Relief, I am satisfied that it is appropriate to make the declarations that are sought. As the declarations identify the contravening conduct, there is no need for me to repeat the detail contained in them. It will be sufficient for me to record that three forms of conduct are involved: the Review Conduct; the Ratings Conduct; and the Referral Conduct.

15    In the following summary, which provides further background to the conduct in question, capitalised expressions have the meanings given in the Statement of Agreed Facts and Admissions and/or the Supplementary Statement of Agreed Facts and Admissions.

The Review Conduct

16    The Review Conduct concerns the period 31 March 2015 to 1 March 2018 and a survey conducted by HealthEngine which was designed to ascertain whether a Patient would recommend a particular Health Practice to others. It also provided the opportunity for Patients who had booked a consultation through one of HealthEngine’s Platforms or a booking widget embedded on the website of some Health Practices (a HealthEngine widget) to provide feedback or comments.

17    HealthEngine did not consider every Patient Review it received or automatically publish these reviews. Further, HealthEngine edited the feedback and comments it received not simply to remove clinical information and information that it would allow Patients to be identified, or to correct typographical and grammatical errors, but to make alterations that removed negative comments and to change the meaning of other comments, including in a way that made them appear more positive than they really were. The changes made are shown in the Revised Schedule of Review Conduct.

18    From about 31 March 2016, HealthEngine implemented a practice of sending a notification email to Patients whose “reviews” had been published. The email sets out the “review” as published and provided a hyperlink to the webpage on which the “review” was published. From about November 2016, the email also informed the Patients concerned that the “review” may have been modified. Beyond this limited disclosure, HealthEngine’s practice in the way it dealt with reviews was not disclosed.

19    HealthEngine accepts that it represented that the Patient Reviews it published on the Platforms in connection with Health Practices were an accurate reflection of the Patient Reviews that it had received from Patients (the genuine reviews representations), when, in fact, they were not an accurate reflection. HealthEngine also accepts that, by publishing each review in the Revised Schedule of Review Conduct, it made a representation that the Patient Review purported to be a testimonial by a Patient relating to services provided by Health Practices, when it was not (the misleading testimonial representations).

The Ratings Conduct

20    The Ratings Conduct is related to the Review Conduct. As I have noted, the survey which HealthEngine conducted included a question – the Ratings Question – designed to ascertain whether the Patient would recommend the Health Practice to others. HealthEngine used this information to calculate a rating for Health Practices that opted to participate. Between 31 March 2015 and 1 March 2018, if 80% or more Patients answered “yes” to the Ratings Question for a Participating Health Practice, HealthEngine published the rating for that practice either as a percentage or, after 1 March 2017, as a number and an image of a star (for example, 4.9*), on the Platforms. If less than 80% of Patients answered “yes” to the Ratings Question, HealthEngine did not publish a practice rating for that Health Practice. Instead, it published on the Platforms a notation indicating that there was no rating. For Participating Health Practices that had a no-rating notation, HealthEngine attached on its website a hover link to the no-rating notation which, when activated, displayed the phrase: “There is currently insufficient data to calculate a patient satisfaction level”. In the app, instead of a hover link, HealthEngine published the statement: “This practice does not have a customer satisfaction score”.

21    HealthEngine accepts that, by publishing the no-rating notation in combination with the hover link phrase on its website or the statement in the app, it represented that it had not received sufficient feedback (either positive or negative) from Patients to enable HealthEngine to calculate and publish on the Platforms a practice rating for the relevant Participating Health Practices (the insufficient feedback representations), when in fact HealthEngine had received sufficient feedback and was able to publish a practice rating, but chose not to do so. Further, HealthEngine accepts that, by engaging in the Review Conduct and Ratings Conduct, it engaged in conduct that was likely to create a more positive or favourable impression in the minds of consumers who used the Platforms to find a suitable Health Practice.

The Referral Conduct

22    In the period 30 April 2014 to 30 June 2018, HealthEngine had arrangements with nine different private health Insurance Brokers for which it received fees for referring Patients to them. HealthEngine provided the Insurance Brokers with Patients’ non-clinical personal information. HealthEngine collected this non-clinical personal information each time a Patient booked an appointment with a Health Practice using the Platforms or a HealthEngine widget. As part of the online booking process, HealthEngine asked Patients whether they had private health insurance. Patients were also asked whether they wished to receive a call about health insurance comparison services or to assess the Patient’s private health insurance needs. It was not necessary for Patients to answer these questions but if a Patient answered “yes” to receiving a call, and then booked an appointment with a Health Practice, HealthEngine provided the Patient’s non-clinical personal information to an Insurance Broker. HealthEngine used language which did not make it adequately clear that a third party (rather than HealthEngine) would provide the relevant services to Patients. Further, HealthEngine did not make it adequately clear that, if the Patient answered “yes”, the Patient’s non-clinical personal information would be sent to one of the Insurance Brokers.

23    HealthEngine accepts that this conduct was liable or likely to cause Patients to believe that HealthEngine provided the relevant services, when it did not and that it then provided non-clinical personal information from the relevant Patients to a third party.

FORMAL ADMISSIONS

24    Section 18 of the ACL provides:

(1)     A person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive.

(2)     Nothing in Part 3‑1 (which is about unfair practices) limits by implication subsection (1).

Note: For rules relating to representations as to the country of origin of goods, see Part 5‑3.

25    Sections 29(1)(b) and 29(1)(e) provide:

A person must not, in trade or commerce, in connection with the supply or possible supply of goods or services or in connection with the promotion by any means of the supply or use of goods or services:

…

(b)     make a false or misleading representation that services are of a particular standard, quality, value or grade; or

…

(e)     make a false or misleading representation that purports to be a testimonial by any person relating to goods or services; or

…

26    Section 34 provides:

A person must not, in trade or commerce, engage in conduct that is liable to mislead the public as to the nature, the characteristics, the suitability for their purpose or the quantity of any services.

Note: A pecuniary penalty may be imposed for a contravention of this section.

27    HealthEngine admits that, by making the genuine reviews representations, HealthEngine, in trade or commerce:

(a)    engaged in conduct that was misleading or deceptive, or likely to mislead or deceive, in contravention of s 18 of the ACL; and

(b)    in connection with the supply or possible supply of services, made false or misleading representations that the services provided by HealthEngine on the Platforms were of a particular standard, quality, value or grade, in contravention of s 29(1)(b) of the ACL.

28    HealthEngine admits that, by making the insufficient feedback representations, HealthEngine, in trade or commerce:

(a)    engaged in conduct in that was misleading or deceptive, or likely to mislead or deceive, in contravention of s 18 of the ACL; and

(b)    in connection with the supply or possible supply of services, made false or misleading representations that the services provided by HealthEngine on the Platforms were of a particular standard, quality, value or grade, in contravention of s 29(1)(b) of the ACL.

29    HealthEngine admits that by engaging in the Review Conduct and Ratings Conduct, HealthEngine engaged in conduct that was likely to create a more positive or favourable impression on consumers who used the Platforms to find a suitable Health Practice, and thereby engaged in conduct that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL.

30    HealthEngine admits that, by making the misleading testimonial representations, HealthEngine, on each occasion it published such a Patient Review, in trade or commerce:

(a)    engaged in conduct that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL; and

(b)    in connection with the supply or possible supply of services, made a false or misleading representation that purported to be a testimonial by Patients relating to services provided by Health Practices, in contravention of s 29(1)(e) of the ACL.

31    HealthEngine admits that by engaging in the Referral Conduct, HealthEngine, in trade or commerce:

(a)    engaged in conduct that was misleading or deceptive or likely to mislead or deceive in contravention of s 18 of the ACL; and

(b)    engaged in conduct that was liable to mislead the public as to the nature, characteristics and/or suitability for their purpose of services provided by HealthEngine, in contravention of s 34 of the ACL.

PECUNIARY PENALTY

32    Section 224 of the ACL provides relevantly:

(1)    If a court is satisfied that a person:

(a)     has contravened any of the following provisions:

…

(ii)     a provision of Part 3-1 (which is about unfair practices);

…     or

(b)         has attempted to contravene such a provision; or

(c)         has aided, abetted, counselled or procured a person to contravene such a provision; or

(d)         has induced, or attempted to induce, a person, whether by threats or promises or otherwise, to contravene such a provision; or

(e)         has been in any way, directly or indirectly, knowingly concerned in, or party to, the contravention by a person of such a provision; or

(f)         has conspired with others to contravene such a provision;

the court may order the person to pay to the Commonwealth, State or Territory, as the case may be, such pecuniary penalty, in respect of each act or omission by the person to which this section applies, as the court determines to be appropriate.

(2)     In determining the appropriate pecuniary penalty, the court must have regard to all relevant matters including:

(a)     the nature and extent of the act or omission and of any loss or damage suffered as a result of the act or omission; and

   (b)     the circumstances in which the act or omission took place; and

(c)     whether the person has previously been found by a court in proceedings under Chapter 4 or this Part to have engaged in any similar conduct.

…

(4)     If conduct constitutes a contravention of 2 or more provisions referred to in subsection (1)(a):

(a)     a proceeding may be instituted under this Schedule against a person in relation to the contravention of any one or more of the provisions; but

(b)      a person is not liable to more than one pecuniary penalty under this section in respect of the same conduct.

33    The Joint Submissions on Contraventions and Relief set out sufficiently the principles upon which civil pecuniary penalties are imposed. Consistently with s 224(4), and as explained in para 22 of the Joint Submissions on Contraventions and Relief, the Commission only seeks penalties in relation to contraventions of s 29(1)(b) of the ACL for the genuine reviews representations and insufficient feedback representations, and s 34 of the ACL for the Referral Conduct. I am satisfied that that approach should be accepted.

34    The parties also submit that the genuine reviews representations, the insufficient feedback representations, and the Referral Conduct, whilst resulting in numerous contraventions of the ACL, can be analysed as three separate categories of contravention to which it is appropriate to apply the course of conduct principle. The course of conduct principle holds that where there is a sufficient interrelationship in the legal and factual elements of the acts or omissions constituting the contravening conduct, the Court may, in its discretion, penalise the acts or omissions as a single course of conduct. I am satisfied that this approach should also be accepted on the facts of this case. However, I hasten to add that this analysis does not convert the many separate contraventions into only three contraventions; nor is the Court required to start from the position that the maximum penalty for a course of conduct is the maximum penalty for a single contravention. I note in this regard that, at the time the contraventions occurred in the present case, the maximum penalty for each contravention by a company of a provision of Part 3-1 of the ACL was $1.1 million.

35    As the Joint Submissions on Contraventions and Relief recognise, the central purpose of imposing civil penalties is deterrence—both specific deterrence and general deterrence. The Joint Submissions on Contraventions and Relief detail and discuss the facts with respect to specific deterrence and general deterrence, as well as the other factors that are relevant to the imposition of pecuniary penalties, in the present case. I have taken these matters into account in my assessment.

36    The parties have agreed, and propose, that a penalty of $1.2 million is appropriate in respect of the contraventions arising from the genuine reviews representations: see [36] of the Supplementary Joint Submissions on Contraventions and Relief. Considered in light of the Statement of Agreed Facts and Admissions, as supplemented by the Supplementary Statement of Agreed Facts and Admissions, the parties have explained the reasoning behind their agreement:

36.1.    (T)he conduct occurred over a period of 2 years and 11 months, and involved HealthEngine not publishing 17,000 reviews from Patients who did not recommend the Health Practice they attended, and editing a further 3,253 reviews to make them more favourable to the Health Practice before publishing them on the Platforms. This conduct may have affected Patients' ability to make an informed choice about matters relevant to the selection of Health Practices free from manipulation of reviews;

36.2.    HealthEngine's editing varied in its substantiveness, with many of the 3,253 edited Patient Reviews being edited in a significant way to remove negative comments. Other reviews were edited to make minor typographical or grammatical amendments, which nonetheless had the effect of changing the meaning of the review or making it appear more positive. However, it is not possible to assess to what extent a consumer's decision-making was affected by the Review Conduct;

36.3.    (T)here is no evidence of any financial loss to consumers arising from the conduct;

36.4.    (G)iven the nature of its business and sources of revenue, it is not possible to quantify the financial gain HealthEngine obtained from making the genuine reviews representations;

36.5.    HealthEngine's senior management did not intend to breach the ACL. They were aware of, and responsible for, the practice of only publishing positive reviews but were not aware of, nor directly involved in, the practice of editing reviews to remove negative content until early in 2017, and the practice of editing reviews reduced significantly after February 2017;

36.6.    HealthEngine has not been found by a court to have previously engaged in similar conduct;

36.7.    (W)hilst HealthEngine's revenues were over $10 million in the financial year ending 30 June 2017 (FY17) and $17 million in the financial year ending 30 June 2018 (FY18), it made net losses of over $15 million and $13 million respectively. These operating losses over the period were significant and included legitimate business costs…

36.8.     HealthEngine's cooperation in relation to the proceedings has been substantial. It cooperated with the ACCC's investigation from the beginning of that investigation. It has made full admissions, agreed to the making of all appropriate orders including the proposed penalty, and joined in the making of submissions which frankly reflect the seriousness of its wrongdoing. The proposed penalty factors in a discount for this cooperation.

37    The parties have agreed, and propose, that a penalty of $300,000 is appropriate in respect of the contraventions arising from the insufficient feedback representations: see [37] of the Supplementary Joint Submissions on Contraventions and Relief. Considered in light of the Statement of Agreed Facts and Admissions, as supplemented by the Supplementary Statement of Agreed Facts and Admissions, the parties have explained the reasoning behind their agreement:

37.1.    (T)he conduct occurred over a period of 2 years and 11 months, and involved HealthEngine representing that it was not publishing a practice rating for Health Practices because it had insufficient data to calculate a score or the Health Practice did not have a score, when HealthEngine could have published a practice rating but chose not to do so because the rating was below 80%. Again, this conduct may have affected consumers' ability to make an informed choice about matters relevant to the selection of Health Practices. However, these representations were only made in relation to, at most, 11% (or 305) of Health Practices and therefore, despite the large number of consumers who view the Platforms each month, it is likely that a significantly lower number of consumers were exposed to this representation when compared to the genuine reviews representations;

37.2.    (T)here is no evidence of any financial loss to consumers arising from the conduct;

37.3.    (G)iven the nature of its business, it is not possible to quantify the financial gain HealthEngine obtained from making the insufficient feedback representations;

37.4.    HealthEngine's senior management did not intend to breach the ACL. They were aware of, and responsible for, the practice of not publishing practice ratings where the rating was less than 80%;

37.5.    HealthEngine has not been found by a court to have previously engaged in similar conduct;

37.6.    (W)hilst HealthEngine's revenues were over $10 million in FY17 and $17 million in FY18, it made net losses of over $15 million and $13 million respectively. These operating losses over the period were significant and included legitimate business costs …;

37.7    HealthEngine's cooperation in relation to the proceedings has been substantial. It cooperated with the ACCC's investigation from the beginning of that investigation. It has made full admissions, agreed to the making of all appropriate orders including the proposed penalty, and joined in the making of submissions which frankly reflect the seriousness of its wrongdoing. The proposed penalty factors in a discount for this cooperation.

38    The parties have agreed, and propose, that a penalty of $1.4 million is appropriate in respect of the contraventions arising from the Referral Conduct: see [38] of the Supplementary Joint Submissions on Contraventions and Relief. Considered in light of the Statement of Agreed Facts and Admissions, as supplemented by the Supplementary Statement of Agreed Facts and Admissions, the parties have explained the reasoning behind their agreement:

38.1.    (T)he conduct occurred for a period of just over 4 years, and resulted in the disclosure to Insurance Brokers of approximately 135,000 Patients' non-clinical personal information without the sufficiently informed consent of those Patients. This conduct occurred in the context set out in paragraph [39] of the Joint Submissions. Patients were asked a question as to whether they 'would like to receive a free call from our private health insurance experts'. By asking this question, Patients were informed and consented to their information being used to contact them in relation to private health insurance, but they were not told that their information would be provided to a third party, and that it was a third party who would contact them for that to occur;

38.2.    (T)here is no evidence of any financial loss to consumers arising from the conduct. There is a direct link between the contravening conduct and the revenue earned from third parties for the referral. The total revenue corresponding with the Referral Conduct was $1,835,336. Whilst HealthEngine did not retain a record of the costs associated with obtaining this revenue during the relevant period, HealthEngine estimates these costs to be approximately $1,335,524;

38.3.    HealthEngine's senior management did not intend to breach the ACL. The referral arrangements with Insurance Brokers were governed by written agreements typically executed by members of HealthEngine's senior management. Accordingly, the Referral Conduct was at the direction of senior management. However, HealthEngine's senior management did not appreciate that the Referral Conduct would constitute a contravention of the ACL;

38.4.    HealthEngine has not been found by a court to have previously engaged in similar conduct;

38.5.    (W)hilst HealthEngine's revenues were over $10 million in FY17 and $17 million in FY18, it made net losses of $15 million and $13 million respectively. These operating losses over the period were significant and included legitimate business costs …;

38.6.     HealthEngine's cooperation in relation to the proceedings has been substantial. It cooperated with the ACCC's investigation from the beginning of that investigation. It has made full admissions, agreed to the making of all appropriate orders including the proposed penalty, and joined in the making of submissions which frankly reflect the seriousness of its wrongdoing. The proposed penalty factors a discount for this cooperation.

39    I accept the submissions reproduced at [36] – [38] above.

40    The parties submit that, although three courses of conduct can be discerned for the purpose of arriving at appropriate pecuniary penalties, it would be appropriate to apply a single pecuniary penalty. They also accept, however, that, on the facts and circumstances of this case, no reduction should be applied under the totality principle (where the Court considers the entirety of the underlying contravening conduct to determine whether the “total” or aggregate penalty is just and appropriate). Here, the parties submit that a single penalty of $2.9 million should be imposed, representing the cumulative total of the three amounts discussed above, without reduction.

41    I am satisfied that it is appropriate to impose a single penalty. The only question is the appropriateness of the amounts which the parties have agreed upon for each course of conduct. Applying the approach which I am required to apply (see [10] – [13] above), and having regard to the evidence before me and the joint submissions that have been made, I am satisfied that each amount agreed upon is within the range of penalties that would be appropriate for the contraventions referred to. In other words, each is an appropriate penalty for the contraventions in question. Further, I accept that the imposition of a single penalty of $2.9 million does not warrant any adjustment taking into account the application of the totality principle.

OTHER ORDERS

42    The parties have proposed orders which require HealthEngine to engage in an independent annual review of its existing compliance program for a period of three years and to implement any changes identified as necessary by an independent reviewer (with written confirmation to the Commission that those changes have been made).

43    The parties have also proposed orders which require HealthEngine to contact Patients whose Personal Information was provided to an Insurance Broker during the period 30 April 2014 to 30 June 2018, informing them of the following matters: the fact that their Personal Information was provided to an Insurance Broker; the identity of each Insurance Broker to whom that Patient’s Personal Information was provided; the nature of the Referral Conduct; the fact that the Court has found the Referral Conduct to be in contravention of the ACL; and instructions as to how the Patient can request that his or her Personal Information be deleted. The proposed orders provide for this communication to be in a particular form.

44    I am satisfied that these non-punitive orders are justified and appropriate. The power to make such orders is conferred by s 246(1) of the ACL.

DISPOSITION

45    I am satisfied that it is appropriate to make the orders that the parties have proposed. I note in this regard that HealthEngine will pay the Commission’s costs in an agreed amount.

Associate:

Dated:    20 August 2020