Competition Law and Data Governance Within ACCC Investigations

1. Introduction

Data governance has become a central component of modern competition-law investigations conducted by the Australian Competition and Consumer Commission (ACCC). This is particularly important in digital markets, where competitive advantage may depend not merely on price, market share or physical assets, but on the collection, aggregation, processing, control and exploitation of data.

The ACCC's investigations therefore operate at the intersection of:

competition law;

consumer protection;

privacy and personal information;

confidentiality;

legal professional privilege;

compulsory information-gathering powers;

cybersecurity;

algorithmic transparency;

digital-platform regulation; and

inter-agency information sharing.

Section 155 of the Competition and Consumer Act 2010 (Cth) (CCA) is particularly important. It gives the ACCC compulsory information-gathering powers to obtain information, documents and evidence relevant to its enforcement functions. (ACCC)

At the same time, the ACCC cannot treat all information as simply ordinary investigative material. Data may contain personal information, commercially confidential material, legally privileged communications, trade secrets, source code, customer records and sensitive algorithmic information.

Thus, data governance within an ACCC investigation is essentially the legal framework governing how investigative data is collected, accessed, protected, analysed, disclosed and ultimately used.

2. Meaning of Data Governance in an ACCC Investigation

Data governance can be understood as the system of rules and controls determining:

what information may be collected;

why it may be collected;

how it must be collected;

who may access it;

how it may be analysed;

how confidential or privileged material is segregated;

how personal information is protected;

how information may be shared with other regulators; and

how long investigative information should be retained.

For an ACCC investigation, this creates two parallel obligations.

ACCC's obligation

The ACCC must ensure that its investigative powers are exercised lawfully and for legitimate statutory purposes.

Investigated firm's obligation

A company receiving an information request must establish appropriate systems for:

identifying responsive information;

preserving electronic evidence;

preventing destruction or alteration;

identifying privileged documents;

protecting confidential information;

complying with the notice;

maintaining an audit trail; and

producing information in the required form.

This is particularly significant because modern ACCC investigations can involve millions of emails, chat messages, transaction records, customer datasets, source-code repositories, metadata and algorithmic documentation.

3. Section 155 CCA: The Core Investigative Power

Section 155 is the principal investigative mechanism.

It enables the ACCC, where statutory conditions are satisfied, to require a person to:

provide information;

produce documents; or

give evidence.

The ACCC describes s 155 as a compulsory information-gathering power used in enforcement investigations and other regulatory functions. (ACCC)

The importance of s 155 has increased dramatically because "documents" in the modern digital environment may include:

emails;

instant messages;

Slack or Teams communications;

databases;

spreadsheets;

customer records;

cookies;

advertising identifiers;

source code;

algorithmic models;

internal dashboards;

data dictionaries;

machine-learning training data;

contracts;

APIs;

server logs; and

metadata.

Consequently, data governance is now inseparable from s 155 compliance.

4. The ACCC Must Have a Statutory Investigative Purpose

The ACCC does not possess an unrestricted power to demand information merely because information might be interesting or useful.

The information must be connected with a matter that constitutes, or may constitute, a contravention within the statutory framework.

This principle is important because data governance imposes a form of purpose limitation on investigations.

The ACCC may investigate questions such as:

Did a dominant digital platform use customer data to exclude competitors?

Did a company share competitively sensitive information with rivals?

Did a platform use non-public business data to favour its own services?

Did an acquisition combine datasets in a way that materially increased barriers to entry?

But the existence of huge quantities of data does not itself mean that all available data becomes automatically relevant.

5. Case Law

Case 1 — Daniels Corporation International Pty Ltd v ACCC (2002) 213 CLR 543; [2002] HCA 49

This is one of the most important Australian authorities concerning ACCC investigative powers and legal professional privilege.

The ACCC issued s 155 notices seeking documents held by solicitors acting for Daniels Corporation.

The High Court held that s 155 did not abrogate legal professional privilege.

Accordingly, properly privileged communications did not have to be produced merely because they fell within the apparent scope of an ACCC notice. (ACCC)

Data-governance significance

The decision establishes an important boundary around ACCC data collection.

A company responding to an ACCC investigation should therefore establish a privilege review process before producing large electronic datasets.

For example, a database containing:

emails to lawyers;

legal advice;

litigation strategy;

internal legal memoranda;

cannot simply be handed over wholesale without considering privilege.

The ACCC itself currently recognises that material attracting valid legal professional privilege need not be produced under a compulsory notice. (ACCC)

Principle

Investigative efficiency does not automatically override legal professional privilege.

6. Case 2 — Pyneboard Pty Ltd v Trade Practices Commission (1983) 152 CLR 328

In Pyneboard, the High Court considered the interaction between s 155 and the privilege against exposure to penalties.

The Court held that the statutory scheme could require production notwithstanding the ordinary privilege against exposure to a penalty. (CaseChat)

Data-governance significance

The case demonstrates that different legal protections apply differently to information supplied during an ACCC investigation.

It is therefore dangerous for an investigated company to adopt the simplistic position:

"This information could incriminate us, so we do not have to provide it."

The statutory treatment of:

self-incrimination;

penalty privilege;

legal professional privilege; and

confidentiality

is not identical.

This makes classification of investigative data essential.

7. Case 3 — Seven Network Ltd v ACCC [2004] FCAFC 267

In Seven Network, the Full Federal Court examined the validity and scope of a s 155 notice.

The Court emphasised the broad investigative function of s 155 and held that information could include the identification and location of persons capable of providing relevant information. (CaseChat)

The Court also recognised that information potentially exculpating a party may fall within the scope of the investigative power.

Data-governance significance

This is important for digital investigations because the ACCC may legitimately seek information that is:

inculpatory;

exculpatory;

contextual;

identifying;

relational; or

necessary to locate further evidence.

For example, an ACCC investigation into algorithmic discrimination might require identification of:

engineers responsible for an algorithm;

employees who designed pricing rules;

data scientists responsible for a model;

executives approving data-sharing arrangements.

Consequently, data governance cannot be designed solely around "documents proving wrongdoing."

Investigative datasets may need to preserve the broader evidentiary context.

8. Case 4 — Obeid v ACCC [2014] FCA 839

In Obeid, the Federal Court considered challenges to s 155 examination notices arising from an ACCC investigation into alleged anti-competitive arrangements connected with a tender process. (CaseChat)

The case demonstrates the importance of identifying the statutory connection between:

the matter being investigated;

the alleged contravention; and

the information sought.

Data-governance significance

For companies facing an ACCC investigation, Obeid supports the importance of constructing a scope matrix.

A useful compliance table would identify:

This prevents both under-production and uncontrolled over-production.

9. Case 5 — Google LLC & Google Australia Pty Ltd: Location Data Proceedings

The ACCC's Google location-data proceedings demonstrate the increasing convergence between consumer protection, data governance and competition policy.

The Federal Court found that Google had misled consumers about the collection and use of personal location data through Android devices. (ACCC)

The Court subsequently ordered Google LLC to pay $60 million in penalties. (ACCC)

The ACCC alleged that consumers could believe that turning off "Location History" prevented Google from collecting and using location information, whereas another setting, "Web & App Activity", could also enable collection and use of location information. (ACCC)

Competition significance

Data governance becomes a competition concern when the ability to collect and exploit data contributes to market power.

A platform that obtains extensive data may improve:

targeting;

advertising;

search;

personalisation;

prediction;

product development; and

algorithmic performance.

Thus, poor data governance can potentially reinforce market power, even where the immediate legal claim is framed as consumer protection.

10. Case 6 — ACCC v Google: Privacy Policy and Personal Data Combination

The ACCC also brought proceedings concerning Google's combination of information associated with users' Google accounts with activity on non-Google websites using Google technology.

The ACCC alleged that Google had failed adequately to inform consumers about the change and the expanded use of personal information. (ACCC)

The Federal Court ultimately dismissed the ACCC's case in December 2022, finding that Google's notification and privacy-policy changes were not misleading and that Google obtained user consent. (ACCC)

Why this matters for competition law

This case is particularly useful because it illustrates an important distinction:

Data governance problem ≠ automatically competition-law violation.

A data practice may be:

commercially significant;

privacy-sensitive;

relevant to consumer choice;

without necessarily constituting an abuse of market power or other competition contravention.

For competition enforcement, the ACCC must still establish the relevant competition-law elements.

11. Case 7 — Google's Fitbit Acquisition

The ACCC's examination of Google's proposed acquisition of Fitbit provides a particularly important example of data as a competitive asset.

The ACCC expressed preliminary concerns that Google's acquisition of Fitbit would give Google access to extensive health data, potentially strengthening Google's existing data advantages and increasing barriers to entry. (ACCC)

Fitbit possessed data concerning matters including:

steps;

heart rate;

sleep;

physical activity; and

other health-related information.

Competition-law significance

The case illustrates the concept of data-driven entry barriers.

A merger can raise competition concerns even where the acquired firm's conventional market share is not particularly large if the transaction gives the acquiring firm access to a strategically important dataset.

The relevant question becomes:

Does combining datasets create a competitive advantage that rivals cannot realistically replicate?

12. Case 8 — Google Search Agreements with Telstra and Optus

The ACCC's investigation of Google's Android search arrangements provides a modern illustration of how distribution control and data advantages can interact.

Google admitted that it entered understandings with Telstra and Optus requiring Google Search to be the only search engine pre-installed on certain Android phones. In December 2025, the Federal Court ordered Google Asia Pacific to pay $55 million in penalties. (ACCC)

Data-governance relevance

Search markets generate extremely valuable behavioural data.

Default positioning can therefore influence:

default search → user traffic → queries → behavioural data → improved search/advertising → stronger market position.

This illustrates a possible data feedback loop.

The competitive significance of default arrangements therefore cannot always be assessed merely by looking at immediate consumer prices.

13. Data as a Source of Market Power

The ACCC's Digital Platforms Inquiry has repeatedly emphasised the relationship between data and substantial market power.

The economic mechanism can be represented as:

More users

↓

More data

↓

Better algorithms / targeting

↓

Better services or advertising performance

↓

More users and advertisers

↓

More data

This is a form of data-driven network effect.

The ACCC has described the ability of major platforms to obtain data from their own services and third-party applications as potentially reinforcing their market power. (ACCC)

14. Data Governance and Section 46 Abuse of Market Power

Section 46 CCA prohibits a corporation with substantial market power from engaging in conduct that has the purpose, effect or likely effect of substantially lessening competition.

Data governance can therefore become relevant to an s 46 investigation.

Potential theories include:

A. Data foreclosure

A dominant firm may prevent rivals from accessing important data.

B. Data leveraging

A firm may use data obtained in one market to strengthen its position in another.

C. Self-preferencing through data

A platform may use data generated by third-party businesses to improve its competing products.

D. Exclusive data arrangements

Contracts may restrict competitors' access to strategically important information.

E. Data aggregation

A merger may combine datasets in ways that significantly increase competitive advantages.

F. Data degradation

A dominant platform may deliberately restrict interoperability or data portability to make switching more difficult.

15. Data Governance and Cartel Investigations

Data governance is equally important in cartel investigations.

Modern cartel evidence may exist in:

WhatsApp messages;

Signal messages;

emails;

pricing databases;

shared spreadsheets;

CRM systems;

internal presentations;

meeting calendars;

metadata;

procurement systems; and

cloud storage.

Accordingly, a competition investigation can require forensic reconstruction of communications.

A company must therefore have a defensible system for:

preservation;

collection;

deduplication;

metadata preservation;

privilege review;

confidentiality review;

production; and

chain-of-custody documentation.

16. Data Governance and Algorithmic Investigations

Algorithmic evidence presents a special challenge.

An ACCC investigation might ask:

What data trained the algorithm?

Who designed the algorithm?

What variables were used?

Were competitors' data incorporated?

Was customer data used to disadvantage rivals?

Was proprietary third-party data used?

Were algorithms intentionally designed to favour the platform's own products?

The ACCC has specifically contemplated the need to scrutinise algorithms in the digital-platform context. (ACCC)

This creates a difficult balance.

ACCC interest

The ACCC may need sufficient information to understand how an algorithm operates.

Firm's interest

The company may argue that disclosure could expose:

trade secrets;

source code;

intellectual property;

security vulnerabilities;

commercially sensitive information.

Consequently, algorithmic transparency does not necessarily mean unrestricted disclosure of source code.

17. Confidentiality and Commercially Sensitive Data

Competition investigations often involve extremely sensitive information.

Examples include:

pricing strategies;

customer lists;

supplier contracts;

margins;

future business plans;

product roadmaps;

source code;

strategic forecasts;

market-share information.

The governance challenge is therefore:

How can the ACCC obtain enough information to investigate competition without unnecessarily exposing commercially sensitive information?

A robust framework may include:

confidentiality classifications;

restricted-access repositories;

clean teams;

redaction;

secure data rooms;

access logs;

controlled disclosure;

confidentiality undertakings; and

anonymisation where appropriate.

18. Personal Information Within ACCC Investigations

Digital-platform investigations can involve enormous volumes of personal information.

For example:

Customer database

→ names
→ email addresses
→ location
→ browsing history
→ purchase history
→ device identifiers
→ behavioural profiles.

The ACCC must therefore consider the interaction between competition enforcement and Australia's broader privacy regulatory framework.

This is particularly significant because the ACCC and privacy regulators have increasingly recognised that digital-platform problems can overlap across regulatory regimes.

In June 2026, Australia's Digital Platform Regulators Forum announced strengthened coordination among regulators concerning competition, privacy, online safety and related digital-platform issues. (ACCC)

19. Data Minimisation

An important governance principle is data minimisation.

The objective is not necessarily to collect every conceivable piece of information.

Instead:

Collect enough information to answer the legally relevant investigative question.

For example, if the ACCC needs to determine whether a company coordinated prices between January and December 2025, it may need:

relevant pricing communications;

pricing records;

meeting records;

communications with competitors.

It may not necessarily need unrelated employee medical records or unrelated personal photographs.

Data minimisation therefore reduces:

privacy risk;

cybersecurity risk;

review costs;

privilege disputes;

irrelevant disclosure; and

regulatory exposure.

20. Legal Professional Privilege as a Data-Governance Control

Following Daniels, privilege review is a critical component of ACCC investigative data management.

A large electronic dataset may contain:

5 million documents

but only a fraction may be:

responsive;

non-privileged;

relevant;

confidential;

producible.

A proper workflow should therefore be:

Collection

↓

Data processing

↓

Deduplication

↓

Relevance review

↓

Privilege review

↓

Confidentiality classification

↓

Production

This prevents privileged material from being inadvertently disclosed.

The ACCC's current guidance expressly recognises the importance of identifying and substantiating privilege claims in responses to compulsory notices. (ACCC)

21. Self-Incrimination and Corporate Data

The interaction between data governance and self-incrimination is also important.

Pyneboard demonstrates that statutory investigative powers can modify ordinary protections concerning exposure to penalties. (CaseChat)

Therefore, companies should not simply classify every damaging document as legally protected.

Instead, counsel should distinguish:

legal professional privilege;

privilege against self-incrimination;

confidentiality;

trade-secret protection;

privacy protection; and

ordinary commercial sensitivity.

These are legally different concepts.

22. Cybersecurity During ACCC Investigations

Large investigations create cybersecurity risks for both sides.

A production may contain:

customer information;

financial information;

passwords or credentials inadvertently embedded in documents;

source code;

security architecture;

authentication information;

proprietary algorithms.

Accordingly, a sophisticated data-governance system should provide:

Access control

Only authorised personnel should access investigative datasets.

Encryption

Data should be protected both in transit and at rest.

Audit logs

The organisation should record who accessed or modified investigative material.

Segmentation

Highly sensitive data should be separated from ordinary evidence.

Incident response

There should be a plan for accidental disclosure or cybersecurity incidents.

23. Cross-Border Data

Digital companies frequently store Australian information overseas.

An ACCC investigation may therefore encounter:

US cloud servers;

European data centres;

Asian subsidiaries;

global email systems;

foreign parent companies.

This creates potential conflicts involving:

privacy laws;

secrecy laws;

data-localisation requirements;

employment laws;

foreign blocking statutes;

privilege;

contractual restrictions.

A company cannot simply assume:

"The data is overseas, therefore the ACCC cannot require it."

Nor should the ACCC assume that geographical location eliminates the need to consider foreign-law restrictions.

Cross-border investigations therefore require coordinated legal and technical analysis.

24. Data Governance in Merger Investigations

Data governance is particularly important during merger reviews.

The ACCC may ask whether a transaction will:

combine previously separate datasets;

eliminate a potential competitor;

create economies of scope;

strengthen network effects;

increase switching costs;

facilitate targeted advertising;

raise barriers to entry.

The Fitbit analysis demonstrates how health data can become relevant to competitive assessment. (ACCC)

The competitive asset is therefore not merely:

"the database."

It may be the ability to combine, analyse and monetise the database.

25. Data as a Non-Price Competitive Variable

Traditional competition analysis often focuses on:

price;

output;

market share.

Digital markets require additional variables:

privacy;

data collection;

data quality;

interoperability;

security;

transparency;

consumer control.

A reduction in privacy may potentially constitute a deterioration in the quality dimension of competition.

The ACCC has expressly examined consumer understanding of data collection and use in its Digital Platforms Inquiry. (ACCC)

Thus:

Competition can occur on privacy and data-governance quality as well as price.

26. Data Portability and Switching Costs

Another important issue is whether consumers or businesses can move their data between competing services.

If a dominant platform makes it difficult to transfer data, switching costs may increase.

The competitive chain can become:

Data lock-in

→ higher switching cost

→ lower customer mobility

→ reduced competitive pressure

→ greater market power

Data portability can therefore have competition significance independently of traditional price competition.

27. Information Sharing Between Regulators

Data governance becomes especially important when several regulators are involved.

Digital-platform conduct may simultaneously concern:

ACCC;

Office of the Australian Information Commissioner;

Australian Communications and Media Authority;

Australian Securities and Investments Commission;

Australian Prudential Regulation Authority;

Reserve Bank of Australia; or

foreign competition and privacy regulators.

The June 2026 Digital Platform Regulators Forum agreement illustrates the increasing importance of coordination and legally permitted information sharing across regulatory bodies. (ACCC)

The governance question therefore becomes:

What information can legally be shared, with whom, for what purpose, and subject to what confidentiality protections?

28. Difference Between Privacy Law and Competition Law

This distinction is crucial.

The Google cases demonstrate why the distinction matters.

A data practice may violate consumer-protection rules without necessarily violating competition law. Conversely, a data practice may be competition-relevant because it strengthens market power even where there is no direct privacy violation.

29. Practical ACCC Data-Governance Framework

A company facing an ACCC investigation should ideally establish a Data Governance Investigation Protocol.

Stage 1 — Legal assessment

Identify:

statutory provision involved;

scope of investigation;

possible contraventions;

applicable s 155 notice.

Stage 2 — Preservation

Issue a legal hold covering:

email;

messaging;

cloud storage;

databases;

mobile devices;

collaboration platforms.

Stage 3 — Data mapping

Identify:

data locations;

custodians;

systems;

jurisdictions;

formats.

Stage 4 — Classification

Classify information as:

responsive;

irrelevant;

privileged;

confidential;

personal;

commercially sensitive.

Stage 5 — Review

Conduct:

relevance review;

privilege review;

confidentiality review.

Stage 6 — Production

Produce data in a manner preserving:

metadata;

authenticity;

completeness;

evidentiary integrity.

Stage 7 — Post-production controls

Maintain:

production logs;

copies of submissions;

privilege schedules;

audit records;

correspondence with the ACCC.

30. Major Legal Principles Emerging From the Cases

The case law can be synthesised into the following principles.

Principle 1 — ACCC investigative powers are powerful

Pyneboard demonstrates the breadth of statutory investigative powers.

Principle 2 — Investigative power is not unlimited

Seven Network confirms the importance of a connection between information sought and the statutory investigative matter.

Principle 3 — Legal professional privilege survives

Daniels establishes that properly privileged material is not automatically producible under s 155.

Principle 4 — Notice validity can be challenged

Obeid demonstrates that recipients may challenge the legal validity and scope of investigative notices.

Principle 5 — Data practices can affect competition

The Google/Fitbit matter demonstrates that access to data can contribute to entry barriers and market power.

Principle 6 — Data practices can produce consumer-law liability

The Google location-data litigation shows that misleading representations about data collection can generate substantial liability.

Principle 7 — Data governance is not itself competition law

The Google privacy-policy case demonstrates that a data practice must still satisfy the elements of the particular statutory cause of action.

Principle 8 — Data can become a strategic competitive asset

Google's search-distribution proceedings demonstrate how control over distribution can reinforce advantages associated with user data and scale. (ACCC)

31. Overall Legal Framework

The modern ACCC investigation can therefore be conceptualised as follows:

                 ACCC INVESTIGATION                        │                        ▼                COMPETITION THEORY                        │          ┌─────────────┼─────────────┐          ▼             ▼             ▼       Market        Conduct        Effects        Power          │             │             │          └─────────────┼─────────────┘                        ▼                  DATA EVIDENCE                        │       ┌────────────────┼────────────────┐       ▼                ▼                ▼   Personal         Privileged       Commercially   Information       Material         Sensitive Data       │                │                │       └────────────────┼────────────────┘                        ▼                DATA GOVERNANCE                        │       ┌────────────────┼────────────────┐       ▼                ▼                ▼   Collection       Access/Use       Disclosure       │                │                │       └────────────────┼────────────────┘                        ▼               LEGALLY CONTROLLED                   INVESTIGATION

32. Conclusion

Data governance within ACCC investigations is no longer merely an administrative or privacy issue. It has become an integral component of competition-law enforcement.

The fundamental challenge is to reconcile two competing objectives:

Effective enforcement

with

lawful and proportionate control over investigative information.

Section 155 gives the ACCC substantial powers to obtain information, documents and evidence. But Daniels demonstrates that legal professional privilege remains a significant boundary; Pyneboard illustrates the different treatment of penalty-related privilege; Seven Network and Obeid establish important principles concerning the scope and validity of investigative notices.

At the substantive competition level, the ACCC's digital-platform work demonstrates that data may itself be a source of competitive advantage. The Google location-data litigation, Google privacy-policy proceedings, Fitbit acquisition review and Google Search investigations collectively illustrate the increasingly close relationship between data collection, consumer choice, market power, entry barriers, distribution and competition. (ACCC)

The central proposition is therefore:

In contemporary Australian competition enforcement, data is simultaneously evidence, an economic asset, a potential source of market power, a consumer-protection concern and a regulated object requiring careful governance.

Accordingly, an ACCC investigation involving substantial datasets should be managed not simply as a document-production exercise, but as a legally controlled data-governance process involving relevance, proportionality, privilege, confidentiality, privacy, cybersecurity, evidentiary integrity and competition-law purpose.