Federal Court Rules Against an Internet Provider Over Misleading Billing Service

OUTCOME: Allowed

FEDERAL COURT OF AUSTRALIA

[NAME_2] Commission v [NAME_3] Corporation Limited [2018] FCA 571 File number: VID 317 of 2018

Judge: MOSHINSKY J

Date of judgment: 26 April 2018

Catchwords: CONSUMER LAW – financial services – false or misleading representations – where the respondent ([NAME_3]) provided a service called the Premium Direct Billing Service ([NAME_4]) to domestic and business customers as a default setting on [NAME_3] mobile services (ie, customers were not required to opt-in) – where the [NAME_4] enabled customers to purchase subscriptions to digital content supplied by third parties and have the charges billed to their [NAME_3] account – where the operation of the [NAME_4] led to a significant number of customers unintentionally purchasing and being billed for PDB content subscriptions without their knowledge or consent – where parties prepared an agreed statement of facts and jointly proposed declarations and orders that [NAME_3] pay pecuniary penalties totalling $10 million – whether the [NAME_4] was a "financial product" – whether, in providing the [NAME_4], [NAME_3] was providing a "financial service" – whether proposed orders appropriate – proposed orders made

Legislation: [NAME_5] Commission Act 2001 (Cth), ss 12BAA, 12BAB, 12DB, 12GBA Competition and Consumer Act 2010 (Cth), ss 76, 87B, 131A Crimes Act 1914 (Cth), s 4AA [NAME_5] Commission Regulations 2001 (Cth), reg 2B

Cases cited: [NAME_6] Commissioner v [NAME_6] (2017) 271 IR 321; [2017] FCAFC 113 [NAME_2] Commission v Coles Supermarkets Australia [COMPANY_7] [2014] FCA 1405 [NAME_2] Commission v Coles Supermarkets Australia [COMPANY_7] (2015) 327 ALR 540 [NAME_2] Commission v [NAME_8] (Australia New Media) [COMPANY_7] trading as [NAME_8] (No 2) [2016] FCA 698 [NAME_2] Commission v Reckitt Benckiser (Aust) [COMPANY_7] (2016) 340 ALR 25 [NAME_2] Commission v [NAME_3] Corporation Limited [2004] FCA 987 [NAME_5] Commission v GE Capital Finance Australia, in the matter of GE Capital Finance Australia [2014] FCA 701 Commonwealth v Director, [NAME_9] (2015) 258 CLR 482 NW [COMPANY_7] v [NAME_2] Commission (1996) 71 FCR 285 [COMPANY_10] (in prov liq) and [COMPANY_10] (in prov liq); [NAME_5] Commission v Adler (2002) 42 ACSR 80 Trade Practices Commission v [COMPANY_11] (No 5) (1981) 60 FLR 38; 37 ALR 256 Trade Practices Commission v CSR Limited [1991] ATPR 41-076; [1990] FCA 762

Date of hearing: 24 April 2018

Registry: Victoria

Division: General Division

National Practice Area: Commercial and Corporations

Sub-area: Regulator and Consumer Protection

Category: Catchwords

Number of paragraphs: 90

Counsel for the Applicants: [redacted]

Solicitor for the Applicants: [redacted]

Counsel for the Respondent: [redacted]

Solicitor for the Respondent: [redacted]

BETWEEN: [NAME_2] COMMISSION First Applicant

[NAME_16] Second Applicant

AND: [NAME_3] CORPORATION LIMITED (ABN 33 [PHONE]) Respondent

JUDGE: MOSHINSKY J DATE OF ORDER: 26 APRIL 2018

THE COURT NOTES: the commitments given by the respondent ([NAME_3]) as set out in paragraphs 91 and 92 of the Statement of Agreed Facts and Admissions.

THE COURT DECLARES THAT:

1. The service called the Premium Direct Billing Service ([NAME_4]) supplied by the Respondent ([NAME_3]) since about July 2013 to consumers acquiring mobile services for personal or domestic use (Domestic customers) and small business and corporate customers (Business customers) (together, customers), which enabled customers to purchase subscriptions to digital content (PDB content subscriptions) supplied by third parties ([NAME_17] or [NAME_18]) and have the charges for those PDB content subscriptions billed to their [NAME_3] account, was a financial service within the meaning of the [NAME_5] Commission Act 2001 (Cth) (ASIC Act). 2. [NAME_3], between early 2015 and 7 June 2016, by applying charges for PDB content subscriptions to the accounts of customers who had unintentionally purchased PDB content subscriptions without their knowledge or consent and so had not agreed to acquire the subscriptions (Non-consenting Customers): (a) in trade or commerce represented to Non-consenting Customers that they had agreed to acquire the PDB content subscriptions when in fact the subscriptions had occurred without those customers' knowledge or consent, and so those customers had not agreed to acquire those subscriptions; and (b) thereby, in connection with the supply of the [NAME_4], made a false or misleading representation that Non-consenting Customers had agreed to acquire services in contravention of s 12DB(1)(b) of the ASIC Act. 3. [NAME_3], between about July 2013 and 4 December 2017: (a) represented to customers that barring access to PDB services from a customer's mobile device would result in the customer no longer being charged for PDB content subscriptions after the date the barring was activated, when in fact: (i) barring access to PDB services on a customer's mobile device would only result in the customer not being charged for new PDB content subscriptions through the [NAME_4] after the date on which barring was activated; and (ii) the customer could continue to be charged for any PDB content subscriptions to which the customer subscribed prior to the date the barring was activated; and (b) thereby, in trade or commerce in connection with the supply of the [NAME_4], made a false representation as to the benefits, uses or performance characteristics of the [NAME_4] in contravention of s 12DB(1)(e) of the ASIC Act. 4. [NAME_3], between about July 2013 and 31 May 2016: (a) represented that customers who requested barring of the [NAME_4] would be able to unsubscribe from PDB content subscriptions by texting the word "STOP" in reply to the confirmation SMS that [NAME_17] send to subscribed customers, when in fact customers who had barred Premium SMS services were unable to unsubscribe from PDB content subscriptions as a result of sending such a text message; and (b) thereby in trade or commerce, in connection with the supply of the [NAME_4], made a false representation to customers as to the benefits, uses or performance characteristics of the [NAME_4] in contravention of s 12DB(1)(e) of the ASIC Act. 5. [NAME_3], between about July 2013 and August 2016, in circumstances where customers were acquiring a new mobile service and the mobile number associated with that service had been deactivated for a period prior to such acquisition: (a) impliedly represented that customers acquiring a new mobile service and number would only be charged for PDB content subscriptions incurred by that customer, when in fact some customers who acquired a mobile number formerly allocated to a different customer were charged for PDB content subscriptions associated with the previous customer's deactivated mobile service; and (b) thereby in trade or commerce, in connection with the supply of the [NAME_4], made a false representation to customers as to the benefits, uses or performance characteristics of the [NAME_4] in contravention of s 12DB(1)(e) of the ASIC Act.

THE COURT ORDERS THAT:

6. [NAME_3] pay to the Commonwealth of Australia, within 14 days of the making of this Order, the following amounts by way of pecuniary penalties: (a) in respect of the contraventions declared in paragraph 2, a pecuniary penalty of $7,000,000; (b) in respect of the contraventions declared in paragraph 3, a pecuniary penalty of $1,000,000; (c) in respect of the contraventions declared in paragraph 4, a pecuniary penalty of $1,000,000; (d) in respect of the contraventions declared in paragraph 5, a pecuniary penalty of $1,000,000. 7. [NAME_3] pay the costs of the [NAME_19] of and incidental to these proceedings, to be taxed if not agreed. Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

MOSHINSKY J:

Introduction 1 The respondent ([NAME_3]) is a publicly listed company. [NAME_3] supplies retail telephone and data services for mobile phones and tablet computers (mobile services). It is Australia's largest supplier of mobile services. 2 In or about June 2013, [NAME_3] introduced, for domestic and business customers, a service called the Premium Direct Billing Service (the [NAME_4]). This service enabled customers to purchase third party digital content on a subscription or one-off purchase basis from a third party, and have the charges for that content billed on their [NAME_3] account. Third party digital content purchased via the [NAME_4] (PDB content) included "premium" content services (such as news websites) and downloadable applications (such as games or ringtones) and other content (such as "voting" in television programs). 3 Content purchased via the [NAME_4] was created by providers ([NAME_18]) who did not have a direct relationship with [NAME_3]. Rather, their digital content offerings were compiled and marketed by five third-party providers ([NAME_17]) who had contractual arrangements with [NAME_3] to make the content available for purchase by [NAME_3] customers. 4 During the period July 2013 to date (the relevant period), [NAME_3] did not adequately inform its customers that: (a) the [NAME_4] was a default setting on [NAME_3] mobile services – that is, customers were not required to opt-in to the [NAME_4] on their mobile service prior to purchasing third party digital content; and (b) consequently, if they were to purchase content on their mobile devices, even unintentionally, they would be billed directly by [NAME_3] via the [NAME_4]. 5 Of those customers charged for PDB content, a significant number complained that they had incurred charges without their knowledge or consent. This occurred in circumstances where [NAME_3] did not require its customers to complete any form of identity verification before purchasing PDB content and having PDB content charges billed to their account. For example, customers were not required to sign in to an account, provide a password, send a text message or provide payment details in order to purchase content. 6 The first applicant (the [NAME_19]) and the second applicant, who is an officer of the [NAME_19] and also a delegate for relevant purposes of the [NAME_5] Commission, commenced this proceeding against [NAME_3], alleging that [NAME_3] had made false or misleading representations in relation to financial services, in contravention of s 12DB of the [NAME_5] Commission Act 2001 (Cth) (the ASIC Act). This proceeding is brought under the consumer protection provisions of the ASIC Act, rather than those of the Competition and Consumer Act 2010 (Cth), on the basis that the alleged conduct was engaged in in relation to financial services: see s 131A of the Competition and Consumer Act. 7 In their originating application, the applicants seek: (a) declarations that: the [NAME_4] was a financial service within the meaning of the ASIC Act; and [NAME_3] contravened s 12DB of the Act by making certain representations in connection with the supply of the [NAME_4]; and (b) orders that [NAME_3] pay: pecuniary penalties to the Commonwealth of Australia in respect of the contraventions; and the [NAME_19]'s costs of the proceeding. 8 [NAME_3] has admitted that: the [NAME_4] was a financial service; it made the alleged representations; those representations were false or misleading; and it thereby contravened s 12DB of the ASIC Act. The applicants and [NAME_3] have reached agreement on a statement of agreed facts and admissions (SOAF), a copy of which is annexed to these reasons. It is convenient to note at this point that, by the SOAF, [NAME_3] admits (among other things) that: (a) [NAME_3] was aware from early 2015 that the operation of the [NAME_4] had led to a significant number of its customers unintentionally purchasing PDB content subscriptions without their knowledge or consent and so had not agreed to acquire the subscription (Non-consenting Customers). (b) In these circumstances, by applying charges to those customers' accounts in respect of their purported subscriptions prior to 7 June 2016, [NAME_3] made false or misleading representations in connection with the supply or possible supply of a financial service within the meaning of the ASIC Act to each of the Non-consenting Customers that they had agreed to acquire those subscriptions (when they had not), in contravention of s 12DB(1)(b) of the ASIC Act. 9 As recorded in the SOAF, [NAME_3] estimates that it has provided refunds of at least $5 million to customers in relation to charges for PDB content, some of which has been recovered from [NAME_17]. 10 As set out in [91] of the SOAF, in the course of resolving the [NAME_19]'s investigation, [NAME_3] committed to and has ceased offering the [NAME_4] entirely, with effect from 3 March 2018. 11 Further, as set out in [92] of the SOAF, [NAME_3] has committed to undertake a series of steps designed to provide refunds to affected customers as described in that paragraph. 12 The parties have reached agreement on proposed declarations and proposed orders (as to both penalties and costs). The proposed declarations and orders are set out in a document headed "Orders" (the Minutes of Proposed Orders) that is annexed to an affidavit of [NAME_20], a solicitor employed by the Australian Government Solicitor, the solicitors acting for the applicants, dated 25 March 2018. The Minutes of Proposed Orders include a statement that the Court notes the commitments given by [NAME_3] as set out in [91] and [92] of the SOAF. 13 The proposed declarations are as follows:

1. The service called the Premium Direct Billing Service ([NAME_4]) supplied by the Respondent ([NAME_3]) since about July 2013 to consumers acquiring mobile services for personal or domestic use (Domestic customers) and small business and corporate customers (Business customers) (together, customers), which enabled customers to purchase subscriptions to digital content (PDB content subscriptions) supplied by third parties ([NAME_17] or [NAME_18]) and have the charges for those PDB content subscriptions billed to their [NAME_3] account, was a financial service within the meaning of the [NAME_5] Commission Act [2001] (Cth) (ASIC Act). 2. [NAME_3], between early 2015 and 7 June 2016, by applying charges for PDB content subscriptions to the accounts of customers who had unintentionally purchased PDB content subscriptions without their knowledge or consent and so had not agreed to acquire the subscriptions (Non-consenting Customers): (a) in trade or commerce represented to Non-consenting Customers that they had agreed to acquire the PDB content subscriptions when in fact the subscriptions had occurred without those customers' knowledge or consent, and so those customers had not agreed to acquire those subscriptions; and (b) thereby, in connection with the supply of the [NAME_4], made a false or misleading representation that Non-consenting Customers had agreed to acquire services in contravention of s 12DB(1)(b) of the ASIC Act. 3. [NAME_3], between about July 2013 and 4 December 2017: (a) represented to customers that barring access to PDB services from a customer's mobile device would result in the customer no longer being charged for PDB content subscriptions after the date the barring was activated (the Barring representation), when in fact: (i) barring access to PDB services on a customer's mobile device would only result in the customer not being charged for new PDB content subscriptions through the [NAME_4] after the date on which barring was activated; and (ii) the customer could continue to be charged for any PDB content subscriptions to which the customer subscribed prior to the date the barring was activated; and (b) thereby, in trade or commerce in connection with the supply of the [NAME_4], made a false representation as to the benefits, uses or performance characteristics of the [NAME_4] in contravention of s 12DB(1)(e) of the ASIC Act. 4. [NAME_3], between about July 2013 and 31 May 2016: (a) represented that customers who requested barring of the [NAME_4] would be able to unsubscribe from PDB content subscriptions by texting the word "STOP" in reply to the confirmation SMS that [NAME_17] send to subscribed customers (the Unsubscribe representation), when in fact customers who had barred Premium SMS services were unable to unsubscribe from PDB content subscriptions as a result of sending such a text message; and (b) thereby in trade or commerce, in connection with the supply of the [NAME_4], made a false representation to customers as to the benefits, uses or performance characteristics of the [NAME_4] in contravention of s 12DB(1)(e) of the ASIC Act. 5. [NAME_3], between about July 2013 and August 2016, in circumstances where customers were acquiring a new mobile service and the mobile number associated with that service had been deactivated for a period prior to such acquisition: (a) impliedly represented that customers acquiring a new mobile service and number would only be charged for PDB content subscriptions incurred by that customer (the Carry Over representation), when in fact some customers who acquired a mobile number formerly allocated to a different customer were charged for PDB content subscriptions associated with the previous customer's deactivated mobile service; and (b) thereby in trade or commerce, in connection with the supply of the [NAME_4], made a false representation to customers as to the benefits, uses or performance characteristics of the [NAME_4] in contravention of s 12DB(1)(e) of the ASIC Act. 14 The proposed orders as to pecuniary penalties and costs are as follows: 6. [NAME_3] pay to the Commonwealth of Australia, within 14 days of the making of this Order, the following amounts by way of pecuniary penalties: (a) in respect of the contraventions declared in paragraph 2, a pecuniary penalty of $7,000,000; (b) in respect of the contraventions declared in paragraph 3, a pecuniary penalty of $1,000,000; (c) in respect of the contraventions declared in paragraph 4, a pecuniary penalty of $1,000,000; (d) in respect of the contraventions declared in paragraph 5, a pecuniary penalty of $1,000,000. 7. [NAME_3] pay the costs of the [NAME_19] of and incidental to these proceedings, to be taxed if not agreed. 15 The evidence before the Court at the hearing comprised the affidavit of [NAME_20], referred to above, which annexed the Minutes of Proposed Orders, the SOAF and joint written submissions of the parties. 16 At the hearing, the parties made oral submissions in support of the proposed declarations and orders. There was no issue between the parties as to the applicable principles or as to the application of those principles to the facts of this case. 17 For the reasons that follow, I consider there to be a proper basis for making the proposed declarations. I also consider the proposed penalties, totalling $10 million, to be appropriate penalties and will make orders to this effect. The conduct is, to my mind, at the serious end of the spectrum of contraventions of the false or misleading representation provisions of the ASIC Act. The proposed penalties reflect the seriousness of the offending and should operate as a deterrent against such conduct being engaged in by [NAME_3] or other companies in the future. I will also make the proposed order that [NAME_3] pay the [NAME_19]'s costs of the proceeding.

Applicable principles – making of orders by agreement and declarations 18 The applicable principles as regards the making of orders by agreement and as regards declarations were summarised by Gordon J in [NAME_2] Commission v Coles Supermarkets Australia [COMPANY_7] [2014] FCA 1405 at [70]-[79] as follows: 2.3.1 Orders sought by agreement … 70 The applicable principles are well established. First, there is a well-recognised public interest in the settlement of cases under the [Competition and Consumer Act]: NW [COMPANY_7] v [NAME_1] & Consumer Commission (1996) 71 FCR 285 at 291. Second, the orders proposed by agreement of the parties must be not contrary to the public interest and at least consistent with it: [NAME_1] & Consumer Commission v [NAME_23] of Western Australia Inc (1999) 161 ALR 79 at [18]. 71 Third, when deciding whether to make orders that are consented to by the parties, the Court must be satisfied that it has the power to make the orders proposed and that the orders are appropriate: [NAME_23] at [17] and [20] and [NAME_1] & Consumer Commission v Virgin Mobile Australia [COMPANY_7] (No 2) [2002] FCA 1548 at [1]. Parties cannot by consent confer power to make orders that the Court otherwise lacks the power to make: [COMPANY_7] v Trade Practices Commission (1981) 148 CLR 150 at 163. 72 Fourth, once the Court is satisfied that orders are within power and appropriate, it should exercise a degree of restraint when scrutinising the proposed settlement terms, particularly where both parties are legally represented and able to understand and evaluate the desirability of the settlement: [NAME_1] & Consumer Commission v [NAME_24] (South Australia) [COMPANY_7] (Trading as [NAME_25]) [2003] FCA 530 at [21]; [NAME_1] & Consumer Commission v Target Australia [COMPANY_7] [2001] FCA 1326 at [24]; [NAME_23] at [20]-[21]; [NAME_1] & Consumer Commission v [COMPANY_7] [2003] FCA 964 at [11] and [22] and [NAME_1] & Consumer Commission v The [NAME_6] [2007] FCA 1370 at [4]. 73 Finally, in deciding whether agreed orders conform with legal principle, the Court is entitled to treat the consent of Coles as an admission of all facts necessary or appropriate to the granting of the relief sought against it: Thomson Australian Holdings at 164. 2.3.2 Declarations [ADDRESS] has a wide discretionary power to make declarations under s 21 of the Federal Court Act: [NAME_26] (1972) 127 CLR 421 at 437-8; Ainsworth v Criminal Justice Commission (1992) 175 CLR 564 at 581-2 and Tobacco Institute of Australia Ltd v Australian Federation of Consumer Organisations Inc (No 2) (1993) 41 FCR 89 at 99. 75 Where a declaration is sought with the consent of the parties, the Court's discretion is not supplanted, but nor will the Court refuse to give effect to terms of settlement by refusing to make orders where they are within the Court's jurisdiction and are otherwise unobjectionable: see, for example, Econovite at [11]. 76 However, before making declarations, three requirements should be satisfied: (1) The question must be a real and not a hypothetical or theoretical one; (2) The applicant must have a real interest in raising it; and (3) There must be a proper contradictor: [NAME_27] v [NAME_28] at 437-8. 77 In this proceeding, these requirements are satisfied. The proposed declarations relate to conduct that contravenes the ACL and the matters in issue have been identified and particularised by the parties with precision: [NAME_1] & Consumer Commission v [COMPANY_7] (2012) 201 FCR 378 at [35]. The proposed declarations contain sufficient indication of how and why the relevant conduct is a contravention of the ACL: BMW Australia Ltd v [NAME_1] & Consumer Commission [2004] FCAFC 167 at [35]. 78 It is in the public interest for the [NAME_19] to seek to have the declarations made and for the declarations to be made (see the factors outlined in [NAME_19] v [NAME_6] at [6]). There is a significant legal controversy in this case which is being resolved. The [NAME_19], as a public regulator under the ACL, has a genuine interest in seeking the declaratory relief and Coles is a proper contradictor because it has contravened the ACL and is the subject of the declarations. Coles has an interest in opposing the making of them: MSY Technology at [30]. No less importantly, the declarations sought are appropriate because they serve to record the Court's disapproval of the contravening conduct, vindicate the [NAME_19]'s claim that Coles contravened the ACL, assist the [NAME_19] to carry out the duties conferred upon it by the Act (including the ACL) in relation to other similar conduct, inform the public of the harm arising from Coles' contravening conduct and deter other corporations from contravening the ACL. 79 Finally, the facts and admissions in Annexure 1 provide a sufficient factual foundation for the making of the declarations: s 191 of the Evidence Act; [NAME_1] & Consumer Commission v Dataline.Net.Au [COMPANY_7] (2006) 236 ALR 665 at [57]-[59] endorsed by the [ADDRESS] in [NAME_1] & Consumer Commission v Dataline.Net.Au [COMPANY_7] (2007) 161 FCR 513 at [92]; [NAME_29] v [NAME_30] (No 2) [2007] FCA 2069 at [21]–[22]; Secretary, Department of Health & Ageing v Pagasa Australia Pty Ltd [2008] FCA 1545 at [77]-[79] and Ponzio v B & P Caelli Constructions Pty Ltd (2007) 158 FCR 543.

Applicable principles – pecuniary penalties 19 The contraventions alleged in the present case are against s 12DB of the ASIC Act. Section 12DB (which deals with false or misleading representations) is contained in Pt 2, Div 2, Subdiv D of the ASIC Act. Division 2 deals with unconscionable conduct and consumer protection in relation to financial services. Subdivision D deals with consumer protection. 20 Pecuniary penalties for the alleged contraventions are dealt with in s 12GBA. Section 12GBA(1) relevantly provides that, if the Court is satisfied that a person has contravened s 12DB, the Court may order the person to pay to the Commonwealth such pecuniary penalty, in respect of each act or omission by the person to which the section applies, as the Court determines to be appropriate. 21 Section 12GBA(2) provides that, in determining the appropriate pecuniary penalty, the Court must have regard to all relevant matters including: (a) the nature and extent of the act or omission and of any loss or damage suffered as a result of the act or omission; (b) the circumstances in which the act or omission took place; and (c) whether the person has previously been found by the Court in proceedings under Subdiv G (of Pt 2, Div 2) to have engaged in any similar conduct. These factors are substantially the same as those referred to in s 76(1) of the Competition and Consumer Act (formerly the Trade Practices Act 1974 (Cth)) save for the reference to proceedings under Subdiv G. Hence, the authorities dealing with that provision are of assistance in applying s 12GBA of the ASIC Act. 22 For each contravention of s 12DB, the maximum penalty payable by a body corporate under s 12GBA(3) is 10,000 penalty units. Over the relevant period, the value of a penalty unit has been: (a) between 1 July 2013 and 30 July 2015, $170; (b) between 31 July 2015 and 30 June 2017, $180; and (c) since 1 July 2017 and presently, $210: Crimes Act 1914 (Cth), s 4AA. Therefore, the maximum penalty for a contravention of s 12DB during the relevant period has ranged from $1.7 million to $2.1 million. A contravention of s 12DB occurs each time the relevant false or misleading representation is made to a person. In the present case, it is common ground that there were at least tens of thousands of contraventions (see further below). 23 The principles applicable to the discretion to impose pecuniary penalties have been discussed in many cases. In the context of misleading or deceptive conduct in relation to financial services, the principles were discussed by Jacobson J in [NAME_5] Commission v GE Capital Finance Australia, in the matter of GE Capital Finance Australia [2014] FCA 701 at [69]-[78], citing Trade Practices Commission v CSR Limited [1991] ATPR 41-076; [1990] FCA 762 and [COMPANY_10] (in prov liq) and [COMPANY_10] (in prov liq); [NAME_5] Commission v Adler (2002) 42 ACSR 80 at [125]-[126]. See also [NAME_2] Commission v [NAME_8] (Australia New Media) [COMPANY_7] trading as [NAME_8] (No 2) [2016] FCA 698 at [21]-[25] per Beach J. 24 In Commonwealth v Director, [NAME_9] (2015) 258 CLR 482 ([NAME_9]), the High Court held that, in the context of civil penalty provisions, it was open to the Court to receive submissions, including joint submissions, as to an appropriate penalty. French CJ, Kiefel, Bell, Nettle and Gordon JJ (with whom Keane J agreed) stated at [46] that there is "an important public policy involved in promoting predictability of outcome in civil penalty proceedings" and that "the practice of receiving and, if appropriate, accepting agreed penalty submissions increases the predictability of outcome for regulators and wrongdoers". Their Honours stated that, as was recognised in Trade Practices Commission v [COMPANY_11] (No 5) (1981) 60 FLR 38; 37 ALR 256 and determined in NW [COMPANY_7] v [NAME_2] Commission (1996) 71 FCR 285, "such predictability of outcome encourages corporations to acknowledge contraventions, which, in turn, assists in avoiding lengthy and complex litigation and thus tends to free the courts to deal with other matters and to free investigating officers to turn to other areas of investigation that await their attention". 25 Their Honours stated, at [57], that in civil proceedings there is generally very considerable scope for the parties to agree on the facts and their consequences, and that there "is also very considerable scope for them to agree upon the appropriate remedy and for the court to be persuaded that it is an appropriate remedy". In relation to civil penalty proceedings, their Honours stated at [58]: Subject to the court being sufficiently persuaded of the accuracy of the parties' agreement as to facts and consequences, and that the penalty which the parties propose is an appropriate remedy in the circumstances thus revealed, it is consistent with principle and, for the reasons identified in Allied Mills, highly desirable in practice for the court to accept the parties' proposal and therefore impose the proposed penalty. (Footnote omitted.) 26 Their Honours in [NAME_9] also made observations, at [60]-[61], regarding submissions by a regulator in such a context. 27 It follows from the above that the questions to be determined in the present case include: first, whether the Court is sufficiently persuaded of the accuracy of the parties' agreement as to facts and consequences; and secondly, whether the penalty that the parties propose is an appropriate remedy in the circumstances thus revealed. 28 In [NAME_9], French CJ, Kiefel, Bell, Nettle and Gordon JJ explained the purpose of a civil penalty as follows at [55]: … whereas criminal penalties import notions of retribution and rehabilitation, the purpose of a civil penalty, as [NAME_31] explained in Trade Practices Commission v [COMPANY_32], is primarily if not wholly protective in promoting the public interest in compliance: "Punishment for breaches of the criminal law traditionally involves three elements: deterrence, both general and individual, retribution and rehabilitation. Neither retribution nor rehabilitation, within the sense of the Old and New Testament moralities that imbue much of our criminal law, have any part to play in economic regulation of the kind contemplated by Pt IV [of the Trade Practices Act] … The principal, and I think probably the only, object of the penalties imposed by s 76 is to attempt to put a price on contravention that is sufficiently high to deter repetition by the contravenor and by others who might be tempted to contravene the Act." (Footnotes omitted.)

Application of principles in the present case

Whether, in providing the [NAME_4], [NAME_3] was providing a financial service 29 A threshold issue is whether, in providing the [NAME_4], [NAME_3] was providing a "financial service" within the meaning of the ASIC Act. As noted above, it is upon this basis that the proceeding has been brought under the consumer protection provisions of the ASIC Act rather than those of the Competition and Consumer Act. 30 The relevant factual background to the issue is as follows. 31 As referred to above, the [NAME_4] enabled customers to purchase third party digital content on a subscription or one-off purchase basis from a third party, and have the charges for that content billed on their [NAME_3] account. Third party digital content purchased via the [NAME_4] (referred to in these reasons as "PDB content") included "premium" content services, downloadable applications and other content. Content purchased via the [NAME_4] was created by [NAME_18], who did not have a direct relationship with [NAME_3]. Rather, their digital content offerings were compiled and marketed by five third-party [NAME_17], who had contractual arrangements with [NAME_3] to make the content available for purchase by [NAME_3] customers. 32 The way in which the [NAME_4] was intended by [NAME_3] to operate is described in [22] of the SOAF: 22 During the relevant period, consistent with [NAME_3]'s arrangements with [NAME_17], the process for [NAME_3] customers to subscribe to PDB content and the process for the [NAME_4] was intended by [NAME_3] to operate in the following way: a. a [NAME_3] customer, while using apps or websites on their device, encounters an advertisement for third party digital content; b. if the customer clicks on the advertisement, the customer is taken to a different web-based address associated with a [NAME_18] (third party website); c. on the third party website the customer is presented with a "buy now" or "subscribe" (or similar) button (subscription trigger) in respect of which: i. prior to 7 June 2016, purchasing PDB content required a single click on a "subscribe" or "buy now" (or similar) button; ii. since 7 June 2016, purchasing PDB content required two steps (double­click process): a customer first clicks a "confirmation" button indicating that they agree to the terms and conditions of the service and accept that costs will be charged to their mobile account, and then a second click of a "subscribe" or "buy now" (or similar) button; and iii. since 4 December 2017, new PDB subscriptions were no longer available and customers could only purchase PDB content on a one-off basis; d. if the third party website is operated by or associated with an [NAME_17] then, when the customer clicks a subscription trigger on the website, the [NAME_17] sends the request from the customer to a different web address, which request is picked up by [NAME_3]'s mobile network; e. if that web address is operated by an [NAME_17] and the customer is a [NAME_3] mobile customer, then [NAME_3] transmits either the customer's mobile device number (for example a mobile phone number) or unique identifier to the [NAME_17]; f. the [NAME_17] then sends a Charge Notice to [NAME_3] recording that the customer has purchased content via the [NAME_4]. [NAME_3] sends a response to the [NAME_17] recording whether the Charge Notice was successful or failed; g. after the customer clicks the subscription trigger, the customer was sent SMS messages by the [NAME_17], which included: i. since 21 July 2014, a notification SMS message to be sent to all subscribed customers once every calendar month (notification SMS) and a notification SMS message when the customer incurred $30 of charges and each time the customer incurred an additional $30 of charges in that month (expenditure SMS); ii. since March 2015, an additional subscription confirmation SMS message to be sent to all newly subscribed customers after the customer had signed up for the subscription (confirmation SMS), which confirmation SMS informed the customer about the recurring subscription, the charges to their mobile account, the ability to opt-out by sending a STOP message to a number and contact details for the [NAME_17]'s helpline; and iii. since January 2016, an additional subscription reminder SMS message to be sent to all newly subscribed customers within 24 hours of the confirmation SMS being sent (reminder SMS); and h. for post-paid customers, the purchase is charged to their [NAME_3] account, while for pre-paid customers the purchase is deducted from their prepaid credit. 33 It is convenient to refer to the definition of "financial product" before turning to the definition of "financial service". "Financial product" is defined in s 12BAA of the ASIC Act. Section 12BAA(1)(c) provides that (subject to certain exceptions that are not applicable in the present case), for the purposes of Pt 2, Div 2, a "financial product" includes a facility through which, or through the acquisition of which, a person makes non-cash payments. The expression "non-cash payments" is the subject of elaboration in s 12BAA(6). This provides that, for the purposes of the section, a person makes non-cash payments if they make payments, or cause payments to be made, otherwise than by the physical delivery of Australian currency in the form of notes and/or coins. On the basis of the facts set out above, and these definitions, I accept that, at least in the case of pre-paid customers, the [NAME_4] was a "financial product". In the case of pre-paid customers, the [NAME_4] was a facility through which those customers made non-cash payments for PDB content. 34 Section 12BAA(7) of the ASIC Act provides that (subject to certain exceptions that are not applicable here) certain things are "financial products" for the purposes of Pt 2, Div 2. The list of things includes, in paragraph (k), a credit facility within the meaning of the regulations. 35 The expression "credit facility" is defined for present purposes in reg 2B of the [NAME_5] Commission Regulations 2001 (Cth). This relevantly provides that the following is a "credit facility": the provision of credit (for any period; with or without prior agreement between the credit provider and the debtor; and whether or not both credit and debit facilities are available). The expression "credit" is defined in reg 2B(3) as meaning a contract, arrangement or understanding: (a) under which: payment of a debt owed by one person to another person is deferred; or one person incurs a deferred debt to another person; and (b) including (among other things) credit provided for the purchase of goods or services. 36 On the basis of the facts set out above, and these definitions, I accept that, in the case of post-paid customers, the [NAME_4] was a "credit facility" within the meaning of the regulations and thus a "financial product". For such customers, a deferred debt was incurred to another person and credit was provided for the purchase of goods or services. Thus, in respect of both pre-paid customers and post-paid customers, the [NAME_4] was a financial product. 37 The next question is whether, in providing the [NAME_4], [NAME_3] was providing a "financial service" within the meaning of the ASIC Act. Section 12BAB(1) provides that for the purposes of Pt 2, Div 2, and subject to an exception that is not applicable, a person provides a "financial service" if they (among other things) deal in a financial product. The concept of dealing in a financial product is defined in s 12BAB(7), which relevantly provides that the following conduct constitutes dealing in a financial product: issuing a financial product. I accept that [NAME_3] was issuing the [NAME_4], which is a financial product. On this basis, I am satisfied that, in providing the [NAME_4], [NAME_3] was providing a financial service. 38 I will therefore make the first declaration proposed by the parties. In circumstances where the issue is one of some complexity, and provides the basis for the application of the consumer protection provisions of the ASIC Act rather than those of the Competition and Consumer Act, it is appropriate for this conclusion to be reflected in a declaration.

The contraventions of s 12DB 39 The applicants allege that [NAME_3] contravened, and [NAME_3] accepts that it contravened, s 12DB(1)(b) and (e) of the ASIC Act. Section 12DB(1) of the ASIC Act relevantly provides as follows: A person must not, in trade or commerce, in connection with the supply or possible supply of financial services, or in connection with the promotion by any means of the supply or use of financial services: (b) make a false or misleading representation that a particular person has agreed to acquire services; or … (e) make a false or misleading representation that services have sponsorship, approval, performance characteristics, uses or benefits; … 40 On the basis of the facts and admissions set out in the SOAF, I am satisfied that [NAME_3] did contravene s 12DB(1)(b) and (e) as alleged by the applicant and agreed to by [NAME_3]. I explain, briefly, why I have reached this conclusion.

Proposed declaration 2 41 The first allegation (which is the subject of proposed declaration 2) is that [NAME_3], between early 2015 and 7 June 2016, by applying charges for PDB content subscriptions to the accounts of customers who had unintentionally purchased PDB content subscriptions without their knowledge or consent and so had not agreed to acquire the subscriptions (referred to in the proposed declaration as "Non-consenting Customers"): (a) in trade or commerce represented to Non-consenting Customers that they had agreed to acquire the PDB content subscriptions when in fact the subscriptions had occurred without the customer's knowledge or consent, and so those customers had not agreed to acquire those subscriptions; and (b) thereby, in connection with the supply of the [NAME_4], made a false or misleading representation that Non-consenting Customers had agreed to acquire services in contravention of s 12DB(1)(b) of the ASIC Act. 42 The [NAME_4] has been described above. 43 During the relevant period, [NAME_3] did not adequately inform its customers that: (a) the [NAME_4] was a default setting on [NAME_3] mobile services – that is, customers were not required to opt-in to the [NAME_4] on their mobile service prior to purchasing third party digital content; and (b) consequently, if they were to purchase content on their mobile devices, even unintentionally, they would be billed directly by [NAME_3] via the [NAME_4] (SOAF, 11]). 44 As set out in [14]-[15] and [93] of the SOAF, (a) [NAME_3] was aware from early 2015 that the operation of the [NAME_4] had led to a significant number of its customers unintentionally purchasing PDB content subscriptions without their knowledge or consent and so had not agreed to acquire the subscription. (b) By applying charges in respect of purported subscriptions to the accounts of customers, in circumstances where the purported subscription had occurred without the customer's knowledge or consent and so the customer had not agreed to acquire the subscription, [NAME_3] made false or misleading representations to those customers that they had agreed to acquire PDB content subscriptions when they had not. 45 The parties have not been able to identify the number of affected customers with any precision. However, [NAME_3] admits that there are at least tens of thousands and possibly up to or in excess of 100,000 of such customers (SOAF, [26]). 46 The SOAF does not describe in detail how it was that many customers unintentionally purchased PDB content. At the hearing, senior counsel for the applicants provided the following description: So far as the statement of agreed facts, at least, has been able to confirm, customers would always need to click a subscription trigger. So to that extent there was required some step from a customer, but it was possible to hit that subscription trigger by accident, or inadvertently, or it appears that customers, in various ways, were able to subscribe without appreciating that they had done so and in circumstances where, down the track, very large numbers of them would then notice the charges and complain to [NAME_3] that they did not understand where the charges come from, they did not recall purchasing or intend to purchase the content for which they were being charged, and hence the very large volumes of complaints that [NAME_3] was receiving from its customers directed at complaining that they were being charged for things they had not wanted to purchase. Senior counsel for [NAME_3] did not indicate any disagreement with this description. 47 I note that the alleged false or misleading representations are said to have been made by [NAME_3] applying charges for PDB content to the accounts of the relevant customers. It is perhaps a little unusual for a representation to take this form. However, I accept that, in the circumstances of the present case, the application of the charges constituted the making of the alleged representations. Further, as senior counsel for [NAME_3] submitted at the hearing, the form of the alleged representation emerges from the terms of s 12DB(1)(b). 48 On the basis of the facts and matters referred to above, and the SOAF generally, I am satisfied that [NAME_3] contravened s 12DB(1)(b) as set out in proposed declaration 2. It is therefore appropriate to make that declaration.

Proposed declaration 3 49 The second allegation (which is the subject of proposed declaration 3) is that [NAME_3], between about July 2013 and 4 December 2017: (a) represented to customers that barring access to PDB services from a customer's mobile device would result in the customer no longer being charged for PDB content subscriptions after the date the barring was activated, when in fact: (i) barring access to PDB services on a customer's mobile device would only result in the customer not being charged for new PDB content subscriptions through the [NAME_4] after the date on which barring was activated; and (ii) the customer could continue to be charged for any PDB content subscriptions to which the customer subscribed prior to the date the barring was activated; and (b) thereby, in trade or commerce in connection with the supply of the [NAME_4], made a false representation as to the benefits, uses or performance characteristics of the [NAME_4] in contravention of s 12DB(1)(e) of the ASIC Act. 50 The factual basis for this allegation is set out, in particular, at [68]-[69] of the SOAF. 51 On the basis of those facts and matters, and the SOAF generally, I am satisfied that [NAME_3] contravened s 12DB(1)(e) as set out in proposed declaration 3. It is therefore appropriate to make that declaration.

Proposed declaration 4 52 The third allegation (which is the subject of proposed declaration 4) is that [NAME_3], between about July 2013 and 31 May 2016: (a) represented that customers who requested barring of the [NAME_4] would be able to unsubscribe from PDB content subscriptions by texting the word "STOP" in reply to the confirmation SMS that [NAME_17] send to subscribed customers, when in fact customers who had barred Premium SMS services were unable to unsubscribe from PDB content subscriptions as a result of sending such a text message; and (b) thereby in trade or commerce, in connection with the supply of the [NAME_4], made a false representation to customers as to the benefits, uses or performance characteristics of the [NAME_4] in contravention of s 12DB(1)(e) of the ASIC Act. 53 The factual basis for this allegation is set out, in particular, at [70]-[72] of the SOAF. 54 On the basis of those facts and matters, I am satisfied that [NAME_3] contravened s 12DB(1)(e) as alleged. It is therefore appropriate to make the proposed declaration.

Proposed declaration 5 55 The fourth allegation (which is the subject of proposed declaration 5) is that [NAME_3], between about July 2013 and August 2016, in circumstances where customers were acquiring a new mobile service and the mobile number associated with that service had been deactivated for a period prior to such acquisition: (a) impliedly represented that customers acquiring a new mobile service and number would only be charged for PDB content subscriptions incurred by that customer, when in fact some customers who acquired a mobile number formerly allocated to a different customer were charged for PDB content subscriptions associated with the previous customer's deactivated mobile service; and (b) thereby in trade or commerce, in connection with the supply of the [NAME_4], made a false representation to customers as to the benefits, uses or performance characteristics of the [NAME_4] in contravention of s 12DB(1)(e) of the ASIC Act. 56 The factual basis for this allegation is set out, in particular, at [73]-[77] of the SOAF. 57 On the basis of those facts and matters, and the SOAF generally, I am satisfied that [NAME_3] contravened s 12DB(1)(e) as set out in proposed declaration 5. It is therefore appropriate to make that declaration. 58 It is convenient to refer at this point to the number of customers affected by the conduct that is the subject of proposed declarations 3, 4 and 5. [NAME_3] is currently unable to determine with precision the number of customers affected by these issues, but admits that it is likely to be in the thousands and may be in excess of 10,000 (SOAF, [78]).

Pecuniary penalties 59 The parties propose the following pecuniary penalties: (a) in respect of the contraventions declared in paragraph 2, a pecuniary penalty of $7,000,000; (b) in respect of the contraventions declared in paragraph 3, a pecuniary penalty of $1,000,000; (c) in respect of the contraventions declared in paragraph 4, a pecuniary penalty of $1,000,000; (d) in respect of the contraventions declared in paragraph 5, a pecuniary penalty of $1,000,000. 60 I consider each of these pecuniary penalties to be an appropriate penalty. My reasons are as follows. In the discussion that follows, I refer to the mandatory considerations referred to in the legislation and the factors identified by [NAME_31] in Trade Practices Commission v CSR Limited [1991] ATPR 41-076; [1990] FCA 762.

Maximum penalty 61 The maximum penalty for each contravention has been referred to at [22] above. 62 The precise number of each type of contravention admitted by [NAME_3] in this proceeding is unknown, but the maximum penalty available for the contraventions that are the subject of proposed declaration 2 is potentially in the hundreds of millions of dollars and, for the other declarations of contravention, at least tens of millions of dollars. In cases such as the present, involving agreement between the parties as to a very large number of contraventions, it is not helpful to seek to make a finding as to the precise number of contraventions, or to calculate a maximum aggregate penalty by reference to such a number: see [NAME_6] Commissioner v [NAME_6] (2017) 271 IR 321; [2017] FCAFC 113 at [143]-[145], citing [NAME_2] Commission v Coles Supermarkets Australia [COMPANY_7] (2015) 327 ALR 540 at [18], [82] and [NAME_2] Commission v Reckitt Benckiser (Aust) [COMPANY_7] (2016) 340 ALR 25 at [139]-[145].

The nature and extent of the contravening conduct and the circumstances in which it took place 63 The operation of the [NAME_4] led to a significant number of [NAME_3] customers unintentionally purchasing and being billed for PDB content subscriptions without their knowledge or consent (termed "Non-consenting Customers") (SOAF, [93]). By applying charges for PDB content subscriptions to the accounts of Non-consenting Customers, [NAME_3] made false or misleading representations to those customers that they had agreed to acquire those subscriptions, when they had not (SOAF, [15], [93]). [NAME_3] has admitted that these contraventions took place between early 2015 and at least June 2016 (SOAF, [93]). 64 [NAME_3] was aware that customers were at risk of unintentional purchases and that customers were being charged for services they had not intended to acquire. 65 [NAME_3] did not adequately inform its customers that: (a) the [NAME_4] was a default setting on [NAME_3] mobile services – that is, customers were not required to opt-in to the [NAME_4] on their mobile service prior to purchasing third party digital content; and (b) consequently, if they were to unintentionally purchase content via the [NAME_4] on their mobile devices without their knowledge or consent, they would be billed by [NAME_3] (SOAF, [11]). 66 The level of complaints of Non-consenting Customers demonstrates the magnitude of the impact of [NAME_3]'s contraventions and the level to which those customers were incurring PDB charges for subscriptions they had not agreed to acquire (SOAF, [24], [26], [38], [42], [46], [57]). For example, in October 2015, [NAME_3] recorded having received approximately 20,000 calls about third party content and in May 2016, approximately 36,000 calls. A significant proportion of these calls related to the [NAME_4]. 67 In a small survey conducted in June 2015 by [NAME_3] of 30 customers recorded as having subscriptions to PDB content services provided by one particular [NAME_17], 80 per cent responded that they were not aware that they had subscribed to a PDB content subscription (SOAF, [37]). All customers who were unaware of the charges opted out when informed of their subscription (SOAF, [37]). Over the relevant period, approximately 2.8 million mobile device numbers had charges applied to them in relation to the PDB content (SOAF, [25]). 68 [NAME_3] took the steps set out in the SOAF to address some of the issues raised by customers who found out they were being charged for subscriptions they had not intentionally acquired, it did not take sufficient steps to ensure its customers had been alerted to the risk of being charged for PDB content subscriptions without their knowledge or consent (SOAF, [56]) or to stop making misrepresentations to them that they had agreed to acquire the services. [NAME_3] neither suspended its offering of the [NAME_4] entirely, nor applied the identity verification safeguards that it applied to other products (SOAF, [14]). 69 [NAME_3] also, until at least August 2016, had a policy of directing all customer complaints about the [NAME_4] in the first instance to the [NAME_17] or [NAME_18] (SOAF, [48]). This policy was in place despite [NAME_3] being aware that, while these entities had Australian local numbers to call, their head offices were in many cases located overseas and that the procedures employed by [NAME_33] for handling customer complaints were frequently time-consuming, difficult to navigate and frustrating for customers (SOAF, [48]). 70 In May 2015, [NAME_3] suspended one [NAME_18], which was responsible for a large proportion of Telecommunications Industry Ombudsman (TIO) complaints referred to [NAME_3] about PDB content. At that stage, [NAME_3] was billing 25,000 customers for content allegedly acquired from that [NAME_18] (SOAF, [35]). [NAME_3] ultimately notified customers subscribed to the services of that [NAME_18], advising them of the charges, their subscription and how to opt out and required the relevant [NAME_17] to implement a 100 per cent customer refund policy on disputed content charges (SOAF, [36]). 71 In 2016, [NAME_3] also "permanently" suspended another [NAME_18], suspended a further seven [NAME_18] and arranged for customers of four of those providers to be unsubscribed and refunded (SOAF, [87]). 72 The three remaining categories of contraventions arose from [NAME_3]'s operation of its own systems and its failure to correct the shortcomings of these systems. The contraventions covered by each of proposed declarations 3, 4 and 5 took place over a period of at least three years. 73 Whereas the Non-consenting Customers contraventions affected at least tens of thousands of [NAME_3] customers, and possibly on [NAME_3]'s estimate as many as 100,000 customers, the other three representations likely collectively affected some thousands of customers and possibly in excess of 10,000. The latter were, accordingly, much less significant in terms of the number of customers affected.

The amount of loss or harm that the contraventions caused 74 Under the [NAME_4] to October 2017: (a) [NAME_3] customers have paid approximately $202 million (excluding GST) in charges; (b) [NAME_3] has applied charges in relation to at least 2,772,005 individual mobile device numbers (more than one of which could belong to a single customer); and (c) [NAME_3] has generated approximately $61.7 million in net revenue (SOAF, [25]), as under [NAME_3]'s arrangements with [NAME_17], [NAME_3] was paid a fee of approximately 30 per cent of the PDB content charge levied on its customers. 75 [NAME_3] cannot identify with precision what proportion of the approximately $202 million that [NAME_3] has charged to its customers' accounts through the [NAME_4] to October 2017 was affected by one or more representations. However, given the time period over which the contraventions occurred and the significant number of customers impacted by those contraventions, it is likely that the actual harm caused has been significant. 76 To date, [NAME_3] estimates that it has provided refunds of at least $5 million to customers in relation to charges for PDB content, some of which it has recovered from [NAME_17] (SOAF, [90]). [NAME_3] has also directed [NAME_17] to refund at least 28,000 [NAME_3] customers to the value of at least $400,000 in relation to PDB content charges (SOAF, [90]).

The size of the contravening entity and its financial position 77 [NAME_3] is a substantial corporation. It is Australia's largest supplier of mobile services with over 17 million mobile services supplied to customers (SOAF, [6]). Its earnings in the 2016 financial year, before interest, tax, depreciation and amortisation were approximately $10.5 billion (SOAF, [6]).

Whether the conduct was systematic or deliberate 78 [NAME_3] designed the [NAME_4] and made the decisions to implement it in the ways set out in the SOAF. In particular, [NAME_3]'s design and implementation of the [NAME_4] enabled customers to acquire PDB content without providing any verification of their identity or other confirmation of purchase (for example, the sending of a text message or providing a PIN number) and for content charges associated with the PDB content to be applied to the customer's account. 79 [NAME_3] received a significant number of complaints about the [NAME_4] directly through its own call centre and indirectly through the TIO (SOAF, [30]). From early 2015 to at least June 2016, [NAME_3] was aware from these complaints and also through a number of internal studies that the operation of the [NAME_4] had led to a significant number of its customers unintentionally purchasing PDB content subscriptions without their knowledge or consent, and so had not agreed to acquire the subscription (SOAF, [14]). 80 [NAME_3]'s conduct towards its customers was deliberate in the sense that it was aware from complaints and its own internal analysis that its customers might be billed for a subscription service they had not intended to, or agreed to, acquire (SOAF, [58]) and did not take sufficient steps to prevent this from happening. [NAME_3] took some steps to address the risks of customers being billed for subscriptions that they had not agreed to acquire, however these were ineffective in preventing a significant number of customers from being charged for PDB content subscriptions that they had not agreed to acquire (SOAF, [56]). The conduct of [NAME_3] and its attendant risks, as well as the remediation steps taken and the inadequacy of those steps, were broadly known within [NAME_3], including at senior levels (SOAF, [58]). 81 The three categories of contraventions the subject of proposed declarations 3, 4 and 5 arose from operational errors and system failures that, while they obviously should have been identified and avoided, were inadvertent in origin.

Whether the contravention arose out of the conduct of senior management or at a lower level 82 The issues with the [NAME_4] and the significant number of complaints to [NAME_3] and the TIO concerning the service were reported to senior levels of management within [NAME_3]. The decision not to either terminate the [NAME_4] entirely before now, or to adopt further or more effective means to prevent the extent to which customers were being charged for subscriptions they had not agreed to acquire, were taken by senior management.

Whether the company has a corporate culture conducive to compliance with the relevant provisions 83 [NAME_3] took a number of steps over the years to address some concerns with the [NAME_4]. However, these steps were inadequate and the fact that the steps were inadequate was broadly known within [NAME_3], including at senior levels (SOAF, [58]). [NAME_3] did not take the necessary steps to ensure customers were not misled. Nor did it stop offering the [NAME_4] while problems with the service remained unresolved. [NAME_3] has previously been involved in the consumer protection issues noted below.

Co-operation 84 [NAME_3] has afforded the [NAME_19] a very high level of co-operation in these proceedings, and throughout the investigation. It has admitted that its conduct contravened s 12DB(1)(b) and (e) of the ASIC Act (SOAF, [93]-[95]). [NAME_3]'s co-operation has saved the [NAME_19] and the Court the cost and burden of litigating what would otherwise have likely involved a lengthy and expensive case. I accept the parties' submission that [NAME_3] is entitled to a substantial co-operation discount.

Similar conduct in the past 85 On 7 November 2017, [NAME_3] gave the [NAME_19] an undertaking under s 87B of the Competition and Consumer Act in relation to [NAME_3]'s representations about speeds available to consumers on its broadband plans supplied over the National Broadband Network, which were likely to contravene ss 18, 29(1)(b) and 29(1)(g) of the Australian Consumer Law (being Sch 2 to the Competition and Consumer Act). 86 In October 2017, [NAME_3] agreed to refund its annual AFL Live Pass app subscriber customers after it had failed to disclose to them that the live AFL match services it would be offering on tablet computers were to be reduced to a smaller screen size, and so would no longer be full-screen on tablets. 87 In 2004, this Court made orders declaring that [NAME_3] had contravened ss 52 and 53(e) of the Trade Practices Act in connection with $0 mobile phone advertising: see [NAME_2] Commission v [NAME_3] Corporation Limited [2004] FCA 987.

Other matters relevant to penalty 88 In the course of resolving the [NAME_19]'s investigation, [NAME_3] committed to and has ceased offering its [NAME_4], with effect from 3 March 2018, and has committed to identify, communicate and offer the refunds as identified in the SOAF (SOAF, [91]-[92]).

Summary 89 In summary, in my view, the conduct is at the serious end of the spectrum of contraventions of the false or misleading representation provisions of the ASIC Act. The proposed penalties reflect the seriousness of the offending and should operate as a deterrent against such conduct being engaged in by [NAME_3] or other companies in the future.

Accordingly, I will make orders for pecuniary penalties in the amounts proposed by the parties.

Conclusion 90 For the above reasons, I will make declarations and orders substantially in the form proposed by the parties. I certify that the preceding ninety (90) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Moshinsky.

Associate: Dated: 26 April 2018 APPENDIX STATEMENT OF AGREED FACTS AND ADMISSIONS 1. This Statement of Agreed Facts and Admissions is made jointly by the first applicant (the [NAME_2] Commission ([NAME_19])), the second applicant and the respondent ([NAME_3]) for the purposes of section 191 of the Evidence Act 1995 (Cth). AGREED FACTS Parties 2 The [NAME_19] is the statutory authority responsible for enforcing the Competition and Consumer Act 2010 (Cth) (CCA). 3 Under section 102 of the [NAME_5] Commission Act 2001 (Cth) (ASIC Act), the [NAME_5] Commission has relevantly delegated all of the functions and powers conferred on it under Division 2 of Part 2 of the ASIC Act (other than section 12GLC and Subdivisions GB and GC of Division 2 of Part 2) to the second applicant, the Executive General Manager, Enforcement Division of the [NAME_19], to the extent that those powers and functions may be necessary for, or reasonably incidental to, the commencement and conduct of any proceedings in relation to matters involving financial products and services provided as part of, or in connection with, the supply or possible supply of telecommunications services. 4 [NAME_3] is a publicly listed company incorporated in Australia. [NAME_3] supplies retail telephony and data services for mobile phones and tablets (mobile services). 5 [NAME_3] admits that by reason of the facts set out below it has contravened sections 12DB(1)(b) and (e) of the ASIC Act as set out at [93] to [95] below. Mobile services offered by [NAME_3] 6 [NAME_3] is Australia's largest supplier of mobile services. In financial year 2016 it supplied customers with around 17.2 million mobile services and generated earnings before interest, tax, depreciation and amortisation of about $10.5 billion. 7 Since at least July 2013 to date (the relevant period), [NAME_3] has, in trade or commerce, offered mobile services to consumers for personal or domestic use (Domestic customers) and small business and corporate customers (Business customers) (together customers). [NAME_3] charges for the mobile services either as: a. pre-paid services, where customers purchase credit in advance, and the purchased credit is used to pay for mobile services as the services are used: or b. post-paid services, where customers are billed (generally monthly) in arrears (although some charges, for example access fees, may be charged in advance). 8 From time to time during the relevant period, the mobile services offered by [NAME_3] have enabled customers to access online software and services (digital content), including in the following ways (noting that these proceedings only concern the Premium Direct Billing service described in paragraph [8(d)]): a. for Business customers – via the "[NAME_3]," a web-based portal that enables Business customers to purchase third party digital content. In order to access this content through this portal, the Business customer must create an account with a password and email address. Those customers can apply to have purchases billed to their [NAME_3] mobile account, which requires them to be signed in and to provide their business address and Australian Business Number for each purchase, otherwise they must pay for each purchase via their credit card; b. for Domestic and Business customers – via the web to third party "applications" or "app" stores, such as Apple's App Store or Google's "Google Play" (together app stores) that enable customers to purchase third party digital content. In order to access content through these means, customers must create accounts directly with the app store and, until about early 2017, any purchases were billed by the app store directly to the customers' credit cards. Since early 2017, customers can apply to have purchases via Google Play billed to their [NAME_3] mobile account, which requires customers to select the option to "Bill my [NAME_3] account", enter their [NAME_3] phone number and enter their Google Play password, before confirming each purchase; c. for Domestic and Business customers – Premium SMS service that enables customers to purchase third party digital content, for example daily horoscope or other notifications, or for "voting" in television programs. Access to Premium SMS content requires a "double opt-in": a customer initiates the first request by sending an SMS to a number starting with a 19xxx prefix; then the customer receives a "subscription request" text, and must respond affirmatively (second request) for subscription to take effect; and d. for Domestic and Business customers – Premium Direct Billing service ([NAME_4]) [Footnote: Also sometimes referred to as [NAME_3]'s "Direct Carrier Billing" service] that enables customers to purchase third party digital content on a subscription or one-off purchase basis from a third party, and have the charges for that content billed on their [NAME_3] account. Third party digital content purchased via the [NAME_4] (known as PDB content) includes "premium" content services (such as news websites) and downloadable applications (such as games or ringtones) and other content (such as "voting" in television programs) not obtained from the [NAME_3] or an app store. The way in which [NAME_3] intended customers to access the [NAME_4] throughout the relevant period is set out in paragraph [22]. Content purchased via the [NAME_4] is created by [NAME_18] who do not have a direct relationship with [NAME_3]. Rather, their digital content offerings are compiled and marketed by five third-party providers ([NAME_17]) who have contractual arrangements with [NAME_3] to make the content available for purchase by [NAME_3] customers. These proceedings – outline 9 In or about June 2013, [NAME_3] introduced its [NAME_4]. 10 These proceedings involve false and misleading representations made by [NAME_3] in the course of operating its [NAME_4]. 11 During the relevant period, [NAME_3] did not adequately inform its customers that: a. the [NAME_4] was a default setting on [NAME_3] mobile services – that is, customers were not required to opt-in to (i.e. request [NAME_3] to set up) the [NAME_4] on their mobile service prior to purchasing third party digital content; and b. consequently, if they were to purchase content on their mobile devices, even unintentionally, they would be billed directly by [NAME_3] via the [NAME_4]. 12 [NAME_3] applied charges to a customer's [NAME_3] mobile account through the [NAME_4]. 13 Up to October 2017, [NAME_3] earned approximately $61.7 million net revenue from the [NAME_4]. 14 As a result of complaints received from [NAME_3]'s customers in relation to the [NAME_4] and through a number of internal studies, [NAME_3] was aware from early 2015 to at least June 2016 that the operation of the [NAME_4] had led to a significant number of its customers unintentionally purchasing and being billed for PDB content subscriptions without their knowledge or consent and so had not agreed to acquire the subscription. Despite this awareness, [NAME_3] failed to implement the identity verification safeguards for the [NAME_4] it employed in relation to other services offered or enabled by [NAME_3] as outlined in [8(a) to (c)] above. 15 In these circumstances, by applying charges to customers' accounts who had unintentionally purchased PDB content subscriptions without knowledge or consent and so had not agreed to acquire the subscription prior to June 2016, [NAME_3] made false or misleading representations to those customers that they had agreed to acquire PDB content subscriptions when they had not. 16 For those customers who sought to query [NAME_4] charges or have them stopped or refunded, many were directed by [NAME_3] to raise their dispute with the [NAME_34], where many then encountered significant difficulties in both cancelling the subscription and obtaining a refund in respect of the unauthorised charges. 17 [NAME_3] accepts that it has contravened the law, both in respect of the false or misleading representations set out at paragraph [15] above and in respect of the particular representations set out in further detail at paragraphs [68 to 78] below. It has voluntarily made the frank and full admissions that appear in this document. It has cooperated with the [NAME_19] throughout its investigation and made senior staff available to assist with those inquiries and to meet with the [NAME_19] to resolve issues cooperatively. 18 [NAME_3] has also ceased offering the [NAME_4] entirely with effect from 3 March 2018, and has committed to undertake an extensive communication and refund program in respect of identified customers who may have been affected by [NAME_3]'s admitted contraventions. Further details are set out in paragraph [92] below. [NAME_4] 19 Since about June 2013, [NAME_3] had contracts with [NAME_17] in relation to the [NAME_4] by which customers could purchase PDB content on their mobile device and be charged for that content on their [NAME_3] account, and [NAME_17] would be paid for PDB content by [NAME_3]. 20. [NAME_3] sets its customers' mobile devices to the [NAME_4] as a default setting. 21 The [NAME_4] is, for post-paid customers, a credit facility within the meaning of s.12BAA(7)(k) of the ASIC Act, and for pre-paid customers, a facility through which they make non-cash payments within the meaning of s 12BAA(1)(c) and (6) of the ASIC Act. The [NAME_4] is accordingly a "financial product" within the meaning of the ASIC Act. [NAME_3], by creating and operating the [NAME_4], issues or provides a service in relation to a financial product, within the meaning of s.12BAB(1)(b) or (g) respectively of the ASIC Act, and accordingly supplies to its customers a "financial service" within the meaning of the ASIC Act. 22 During the relevant period, consistent with [NAME_3]'s arrangements with [NAME_17], the process for [NAME_3] customers to subscribe to PDB content and the process for the [NAME_4] was intended by [NAME_3] to operate in the following way: a. a [NAME_3] customer, while using apps or websites on their device, encounters an advertisement for third party digital content; b. if the customer clicks on the advertisement, the customer is taken to a different web-based address associated with a [NAME_18] (third party website); c. on the third party website the customer is presented with a "buy now" or "subscribe" (or similar) button (subscription trigger) in respect of which: i. prior to 7 June 2016, purchasing PDB content required a single click on a "subscribe" or "buy now" (or similar) button; ii. since 7 June 2016, purchasing PDB content required two steps (double­click process): a customer first clicks a "confirmation" button indicating that they agree to the terms and conditions of the service and accept that costs will be charged to their mobile account, and then a second click of a "subscribe" or "buy now" (or similar) button; and iii. since 4 December 2017, new PDB subscriptions were no longer available and customers could only purchase PDB content on a one-off basis; d. if the third party website is operated by or associated with an [NAME_17] then, when the customer clicks a subscription trigger on the website, the [NAME_17] sends the request from the customer to a different web address, which request is picked up by [NAME_3]'s mobile network; e. if that web address is operated by an [NAME_17] and the customer is a [NAME_3] mobile customer, then [NAME_3] transmits either the customer's mobile device number (for example a mobile phone number) or unique identifier to the [NAME_17]; f. the [NAME_17] then sends a Charge Notice to [NAME_3] recording that the customer has purchased content via the [NAME_4]. [NAME_3] sends a response to the [NAME_17] recording whether the Charge Notice was successful or failed; g. after the customer clicks the subscription trigger, the customer was sent SMS messages by the [NAME_17], which included: i. since 21 July 2014, a notification SMS message to be sent to all subscribed customers once every calendar month (notification SMS) and a notification SMS message when the customer incurred $30 of charges and each time the customer incurred an additional $30 of charges in that month (expenditure SMS); ii. since March 2015, an additional subscription confirmation SMS message to be sent to all newly subscribed customers after the customer had signed up for the subscription (confirmation SMS), which confirmation SMS informed the customer about the recurring subscription, the charges to their mobile account, the ability to opt-out by sending a STOP message to a number and contact details for the [NAME_17]'s helpline; and iii. since January 2016, an additional subscription reminder SMS message to be sent to all newly subscribed customers within 24 hours of the confirmation SMS being sent (reminder SMS); and h. for post-paid customers, the purchase is charged to their [NAME_3] account, while for pre-paid customers the purchase is deducted from their prepaid credit. 23 During the relevant period, under [NAME_3]'s arrangements with [NAME_17], [NAME_3] pays the [NAME_17], within 30 days of the end of each calendar month, the total of the amount charged by the [NAME_17] to the customer for the supply of digital content during that month, less various adjustments. [NAME_3] retains a monthly merchant service fee for [NAME_3] providing the [NAME_4], which is usually around 30% of the charges to the customer. 24 Between January 2015 and June 2016, [NAME_3] received a large number of calls from customers disputing the billing for third party digital content. For example, as at October 2015, [NAME_3] recorded having received approximately 20,000 calls about third party content that month and in May 2016, approximately 36,000 calls. A significant proportion of these calls related to PDB content services. While it is not possible to determine the precise number of calls from customers disputing charges billed through the [NAME_4], over the relevant period it would be in the order of tens of thousands and possibly up to or in excess of 100,000. PDB charges incurred by [NAME_3] customers 25 Under the [NAME_4], in the period to October 2017: a. [NAME_3] customers have paid approximately $202 million (excluding GST) in charges; b. [NAME_3] has applied charges in relation to at least 2,772,005 individual mobile device numbers (more than one of which could belong to a single customer); and c. [NAME_3] has generated approximately $61.7 million in net revenue. 26 Of those customers charged for PDB content, a significant number complained that they had incurred charges without their knowledge or consent. [NAME_3], by applying subscription charges to accounts where customers had unintentionally purchased PDB content subscriptions without their knowledge or consent and so had not agreed to acquire the subscription, made false and misleading representations to those customers that they had agreed to acquire those services when they had not. The Parties are not able to identify the number of affected customers with any precision. However, [NAME_3] admits that there are at least tens of thousands and possibly up to or in excess of 100,000 of such customers. Information provided to customers about the [NAME_4] 27 Until at least June 2015, [NAME_3] did not provide any information to its customers before or at the time of signing up for a [NAME_3] mobile service about: a. the fact that its customers could acquire PDB content without providing any form of identity verification; b. how to unsubscribe from PDB content subscriptions; or c. how to bar the [NAME_4] given it was a default setting. 28 In the period from June to September 2015: a. information about PDB content subscriptions was published on [NAME_3]'s website under the title "Take Control of Your Device"; b. references to third party charges were included in [NAME_3] packs; and c. email communications describing purchasing premium content were sent to new mobile post-paid customers. 29 Customers were not adequately informed by [NAME_3] that the [NAME_4] was set as a default on their accounts. Customers who were aware of the [NAME_4] and wanted to bar it could do so by either calling [NAME_3] or filling in an online form available on [NAME_3]'s website. [NAME_3]'s awareness of digital content billing issues 30 Throughout the relevant period [NAME_3] received a significant number of complaints directly through its own call centre and indirectly through the Telecommunications Industry Ombudsman (TIO) about PDB content billing issues, PDB content subscriptions and PDB content charges (PDB complaints). Largely in response to PDB complaints, [NAME_3] made a number of changes to its [NAME_4], set out in further detail below. Complaints and changes to the billing system 31 In March 2015, [NAME_3] noted in an internal communication that the "overwhelming TIO complaint [in relation to PDB and Premium SMS content services] by customers ... is along the lines of 'I discovered 3rd party charging on my bill that I didn't authorise or subscribe to'". By about May 2015, [NAME_3] identified key causes of complaints in relation to PDB and Premium SMS content services, including that: a. "customers don't remember subscribing" to PDB and Premium SMS content; b. it is "unclear how to unsubscribe" from PDB and Premium SMS content; c. customers "cannot get through to third parties"; and d. if they do contact third parties, customers cannot obtain a refund. 32 At that time, [NAME_3]'s own analysis of TIO complaints data showed "that market growth of the newer service, Premium Direct Billing [PDB], largely contributed to the increase in TIO complaints for mobile premium services." 33 At around the same time, [NAME_3] introduced a Premium Mobile Services Complaints Task Force (Task Force) to investigate and analyse the rise in TIO complaints in relation to the PDB and Premium SMS content services. 34 By May 2015, [NAME_3] recorded that it had experienced a significant rise in the number of PDB complaints referred to [NAME_3] from the TIO, which averaged 47 complaints per month from March to May that year. In June 2015, [NAME_3] identified the "root cause" of complaints as customers "opting in" to PDB content subscriptions inadvertently or without a full understanding of the billing implications. 35 Also in May 2015, [NAME_3] suspended the [NAME_18] "[NAME_35]" for new subscriptions, which represented a large proportion of TIO PDB complaints referred to [NAME_3]. At that time, KKO had 25,000 unique subscribers who were [NAME_3] customers and gross revenue attributable to [NAME_3] customers of $1.8 million. 36 In June 2015, [NAME_3] sent SMS messages to 6,590 [NAME_3] customers with existing [NAME_35] subscriptions reminding them of the service costs, where to obtain assistance and how to opt out. [NAME_3] also required the [NAME_17] of [NAME_35] to implement a 100% customer refund policy on disputed content charges. 37 In June 2015, as part of the work of the Task Force, [NAME_3] conducted a small survey of consumers recorded as having been subscribed to PDB content services provided by one particular [NAME_17]. Of the 30 respondents to the survey: a. 80% were not aware that they had subscribed; b. 97% did not know how much they would be charged; c. 77% were never going to use the service; and d. all customers who were unaware of the charges, when informed of their subscription, chose to opt out. This suggested to [NAME_3] that customers were poorly, if at all, informed about the PDB content subscriptions to which they were recorded as having been subscribed. 38 In June 2015, as a response to the number of TIO complaints referred to [NAME_3] relating to PDB and Premium SMS content services, a new escalation process for complaints handling was launched by [NAME_3] that applied to customers who had been first referred to the [NAME_17] or [NAME_18] and then complained a second time to [NAME_3]. In these situations, [NAME_3] assigned a dedicated escalation case manager to work with the [NAME_17] with the aim of resolving the enquiry within three days. However, by March 2016, there was a backlog of over 1,000 customer PDB complaints where [NAME_3] had not called back the customer. By 15 April 2016, [NAME_3]'s Billing Incident Management System commenced dealing with each of these 'Escalated complaints' by [NAME_3] providing refunds to affected customers. During the period from 18 June 2015 to 9 August 2016 (when a dedicated cell of customer service representatives to deal with PDB complaints was launched – see paragraph [49]), [NAME_3] received approximately 29,889 PDB complaints which were classified as 'Escalated complaints'. 39 Also in June 2015, the TIO informed [NAME_3] that it had received a number of complaints indicating that there may be a systemic issue relating to [NAME_3]'s handling of consumer complaints about disputed third party charges. In particular, the TIO focused on [NAME_3]'s practice of referring complaints to third parties in the first instance. 40 In July 2015, [NAME_3] responded to the TIO acknowledging that "qualitative customer research and feedback from our customer support channels" showed that customers had: a. "limited awareness that consent given online for third party subscription content is legitimate without the need to add further personal information to complete this subscription; b. limited awareness that these services browsed and accessed on a mobile phone, are indeed premium third party content and charged at a premium price to their mobile bill; c. limited understanding of the confirmation text messages. These messages are misunderstood and often considered spam, resulting in them often being ignored; and d. limited understanding of how to cancel the ongoing charges incurred from subscription purchases." 41 From March 2015 to September 2015, [NAME_3] experienced a decrease of 40% in referred TIO PDB complaints, yet continued to receive a significant number of complaints directly from customers. 42 Despite the drop in TIO complaints, as at October 2015 and as noted in paragraph [24] above, [NAME_3]'s call centre was receiving approximately 20,000 calls per month "from customers disputing third party content billing" charges, a significant proportion of which were PDB complaints. 43 In January 2016, in addition to the requirements at [22g(iii)], [NAME_3] required the removal of the word 'Freemsg' in the [NAME_17]'s, as it became aware that many customers were mistaking SMS messages from [NAME_17] as spam. 44 In February and March 2016, examples of TIO PDB complaints referred to [NAME_3] included: a. "I received a SMS from [NAME_36] on my mobile but I did not reply to it as I had not subscribed to anything. I was charged for it. I called [NAME_3] and they referred me to the provider." b. "I noticed Third party charges of $41.40 on my bill. I contacted [NAME_3] and was referred to the third party. I do not believe that I authorised a third party to debit my [NAME_3] account. I contacted the third party, sent them the bills as requested and they agreed only to refund $6. 90." c. "I was charged for third party charges. We have never subscribed to anything. We have two young children and at worse one of them may have accidently (sic) triggered the charge. I called [NAME_3] and [NAME_36] and was promised that service will be cancelled and refund but that did not happen." 45 In March 2016, [NAME_3] suspended the addition of new PDB content services available for purchase until key issues with current products and experiences were addressed. [NAME_3] continued to charge customers for new and existing subscriptions and one-off purchases in relation to existing PDB content services for at least 30 [NAME_18] and 5 [NAME_17]. 46 In May 2016, as noted in paragraph [24] above, [NAME_3] received approximately 36,000 calls that month and 250 complaints to the TIO. A significant proportion of these were PDB complaints. 47 In around June 2016, [NAME_3] introduced a requirement for [NAME_17] to include a Terms and Conditions "tickbox" in the sign-up process used to sign up customers to PDB content subscriptions, as referred to in paragraph [22(c)] above. The introduction of this requirement was followed by a decrease in TIO PDB complaints referred to [NAME_3] from 115 in May 2016 to 65 in June 2016. 48 Until at least August 2016, [NAME_3] had a policy in relation to PDB complaints of directing all customer complaints in the first instance to [NAME_17] or [NAME_18] and assisting any customers in barring the service where specifically requested. This policy was in place despite [NAME_3] being aware that while these entities had Australian local numbers to call, their head offices were in many cases located overseas and that [NAME_17]' and [NAME_18]' procedures for handling customer complaints were frequently time-consuming, difficult to navigate and frustrating for customers. 49 In August 2016, [NAME_3] launched a 'dedicated cell' of customer service representatives to handle and seek to resolve PDB complaints made directly to [NAME_3] on the first call. However, as recently as 10 July 2017 there have been instances on [NAME_3]'s Crowd Support forum of [NAME_3] continuing to refer complainants to [NAME_17]. 50 On 15 September 2016, the TIO notified [NAME_3] that it had closed its 2015/16 investigation into [NAME_3]'s handling of PDB complaints, referring in its email to: a. a number of the improvements and safeguards referred to in [NAME_3]'s response to the TIO's questions posed as part of the investigation; and b. an outstanding concern about the itemisation of charges on customers' bills. 51 In addition to TIO complaints referred to [NAME_3], during the relevant period [NAME_3] has received significant volumes of complaints directly from its customers in relation to charges billed for PDB content subscriptions that they did not agree to acquire. 52 In June 2017, results from a survey commissioned by the Australian Communications Consumer Action Network (ACCAN) showed that 12 per cent of respondents, being customers of [NAME_3], Optus, and Vodafone, had experienced unexpected third party charges (which might be charges billed under the [NAME_4], Premium SMS service or some other method of acquiring digital content such as those referred to in paragraph [8] above) on their mobile phone bills in the prior six months. Approximately 50% of the survey respondents were [NAME_3] customers. ACCAN's survey found that: a. over three quarters (77 per cent) of survey respondents who had received a confirmation SMS regarding an unexpected charge attempted to prevent the charge from being processed by replying "STOP" to that SMS, and of those, 71% still had the charge added to their bill; b. over a third (36 per cent) of unexpected charges incurred by those survey respondents were for $10 or more; c. 55% of participants who had experienced an unexpected charge, had done so while having little to no active or intended involvement with the third party. 53 From at least June 2015 to date, there has been widespread media attention about third party digital content billing and industry practices. Media reports noted that customers were regularly reporting they had incurred charges inadvertently, and were experiencing serious difficulties obtaining refunds. 54 Between early 2015 and late 2016, in the course of considering complaints received, and through a number of internal studies, [NAME_3] was aware that a significant number of its customers: a. had little or no awareness of subscribing to third party content; b. were not aware of third party content charges appearing on their accounts; c. denied purchasing the third party content which was incurring charges; d. were unaware that third party content purchases could be effected without the need to add further personal information; and e. did not know how to opt-out of the [NAME_4]. 55 In addition [NAME_3] was aware that many of its customers may not be aware of charges for content billed through the [NAME_4] appearing on their accounts. This was because: a. pre-paid customers do not automatically receive a monthly bill; b. post-paid customers paying by direct debit have charges automatically deducted from their nominated accounts; c. customers' accounts can print to numerous pages; and d. even those customers who did review their accounts will have often found it difficult to determine the identity of the third party on their bill. 56 Despite the complaints received, internal studies and media reports referred to above, and the concerns raised within these reports, the steps taken by [NAME_3] to address the risks of customers being billed for subscriptions that they had not agreed to acquire were ineffective in preventing customers from being charged for PDB content subscriptions without their knowledge or consent. 57 Between September 2014 and May 2016, the [NAME_19] received on average 44 complaints per month about PDB content charges. Despite the changes made by [NAME_3] in June 2016, the [NAME_19] continued to receive on average 43 complaints per month about PDB content charges between June 2016 and September 2017. In addition, while PDB complaints to [NAME_3] decreased for a period of time following the June 2016 changes, complaints directly to [NAME_3] have continued to be received in significant numbers. Further, PDB complaints to the TIO also decreased following the June 2016 changes to 28 in November 2016, but then increased to 125 in May 2017, decreased to 25 in September 2017 and increased again to 60 in October 2017. 58 [NAME_3]'s conduct towards its customers was deliberate in the sense that it was aware from complaints and internal analysis that its customers might be billed for a subscription service they had not intended to, or agreed to, acquire. The conduct of [NAME_3] and its attendant risks, as well as the remediation steps taken and the inadequacy of those steps, were broadly known within [NAME_3], including at senior levels. Safeguards Sign-up process 59 Unlike the procedures for Premium SMS, the [NAME_3] and app stores, [NAME_3] did not require its customers to complete any form of identity verification before purchasing PDB content and having PDB content charges billed to their account. For example, customers were not required to sign in to an account, provide a password, affirmatively send a text message or provide payment details in order to purchase content. 60 PDB content charges were billed as either one-off charges or, more often, subscription charges. Subscription charges were billed on a recurring basis, usually weekly. A commonly reported subscription charge in customer complaints was for $9.90 per week. 61 PDB subscription charges continued to be charged until the customer was able to unsubscribe from the service. Barriers to unsubscribing from the service were: a. customers' lack of awareness of charges; b. customers' lack of awareness as to how to unsubscribe; and c. [NAME_3]'s policy of referring customer complaints, including requests for refunds, to [NAME_33] despite knowledge of the poor complaints handling practices of many of the third parties. 62 Until about January 2016, under [NAME_3]'s Carrier Billing Code of Conduct Policy (Conduct Policy), [NAME_3] required [NAME_17] to include at least one "click" by the customer on a subscription trigger, being a hyperlink appearing on a webpage "pricing notification screen" associated with an [NAME_17] or [NAME_18] which included the words "buy now" or "subscribe now". 63 From about January 2016, in addition to the requirements at [22], under its [NAME_3] required [NAME_17] to include two webpage screens, being a "merchant advertising screen" and the pricing notification screen. [NAME_3] required that a subscription process included at least one click by the customer on a subscription trigger on the pricing notification screen which included the words "Pay", "Pay now", "Purchase", "Subscribe" or "Buy". 64 From about June 2016, in addition to the requirements at [22] and [63], [NAME_3] required [NAME_17] to include the extra step of its customers clicking on a terms and conditions "tickbox" on the pricing notification screen (the double-click process referred to in paragraph [22(c)] above) when purchasing PDB content subscriptions. 65 Between 4 December 2017 and 2 March 2018, new PDB content subscriptions were no longer available and customers could only purchase PDB content on a one-off basis. In order to acquire PDB content as a one-off purchase, customers were only required to click on the "buy now" (or similar) button once. Additional process deficiencies 66 During the relevant period, [NAME_3] became aware that some of its customers were charged multiple times for the same PDB content, and that [NAME_3] was being provided with multiple Charge Notices for the same content service on consecutive days. [NAME_3] subsequently arranged for those customers to receive refunds. 67 [NAME_3] was also aware that family members such as children were at risk of inadvertently subscribing to PDB content on the family member's phone. In [NAME_3]'s response to an information request from the TIO, [NAME_3] noted that: "Customer consent may have been provided by a family member of the account holder of the phone. For example, in app advertising, particularly with games – consent is given by the person using the phone, such as children playing on their parent's phone". Customers who requested PDB barring 68 Throughout the relevant period until 4 December 2017, [NAME_3] has, by its terms relating to its [NAME_4] in its Our Customer Terms, represented to customers that barring the [NAME_4] would prevent further charges being applied to their accounts. However, [NAME_3] was aware that barring the [NAME_4] would not unsubscribe a customer from an existing subscription. [NAME_3] did not notify customers of this fact but has agreed to refund all impacted customers. 69 In July 2015, [NAME_3] provided training to its front of house staff in which it was confirmed to those staff that barring would not cancel charges under existing services and that customers would first have to unsubscribe before applying barring, and that customers who sought to apply barring to the [NAME_4] should be informed of this fact. [NAME_3] admits the training in July 2015 was ineffective in preventing a significant number of its customers from continuing to be billed by [NAME_3] in circumstances where those customers had attempted to unsubscribe from an existing subscription by barring the [NAME_4]. Customers unable to unsubscribe who had barred Premium SMS services 70 In order to unsubscribe from a PDB subscription, customers were required to either call the relevant [NAME_17]'s or [NAME_18]'s call centre or to SMS 'STOP' in reply to the confirmation SMS that [NAME_17] send to subscribed customers. However, prior to 31 May 2016, if a customer had barred Premium SMS services then that customer could not send the 'STOP' SMS to unsubscribe from the PDB subscription. 71 [NAME_3] being aware of this issue from at least May 2015, [NAME_3] did not notify the affected customers and continued to apply charges to these customers' accounts. 72 In May 2016, [NAME_3] implemented a change to its system that enabled customers who had barred Premium SMS to unsubscribe from a PDB subscription using a 'STOP' SMS. [NAME_3] did not notify all customers who had previously barred Premium SMS of this change and had PDB content charges applied to their mobile accounts of this change, but has agreed to offer refunds to all impacted customers. New customers charged for old customers' subscriptions 73 When a customer acquires a mobile phone service from [NAME_3], they are sometimes allocated a number used by a previous [NAME_3] customer, which number had been in "quarantine" for a number of months. In certain circumstances the previous user of the phone number had a PDB subscription. 74 Until at least 26 August 2016, some customers who acquired a previously quarantined (i.e. deactivated) [NAME_3] mobile number incurred charges from the previous owner of the [NAME_3] number, where the previous owner had been subscribed to PDB content. This was made possible by [NAME_3], until at least August 2016, not preventing [NAME_17] from continuing to send Charge Notices for each [NAME_3] mobile number, including when the number had been deactivated and ported to a new customer. 75 Despite being aware of this, by allocating the mobile number in the circumstances described above, [NAME_3] impliedly represented to those customers that they would not be billed for PDB subscription charges carried over from the previously deactivated mobile service, when in fact those customers were billed for those carried over PDB subscription charges. 76 On about 26 August 2016, [NAME_3] implemented a process change to address this issue by limiting the number of unsuccessful Charge Notices which could be submitted to [NAME_3] to a maximum of four for each service within a 14 day period, after which the [NAME_17] must take steps to unsubscribe that subscription service. Content subscriptions associated with deactivated mobile services would therefore be unsubscribed, as the Charge Notices sent in respect of those deactivated services would have been unsuccessful. [NAME_3] does not know and until recently did not check whether customers continued to incur charges that they had not consented to due to a PDB subscription by a previous owner of a mobile device number. 77 During the relevant period, [NAME_3] identified and refunded some customers that were affected by this issue. However, despite [NAME_3]'s knowledge of this issue from at least August 2016, [NAME_3] was not able to identify or refund all such customers. [NAME_3] is in the process of identifying all customers affected by this issue and has agreed to refund those not previously refunded. 78 [NAME_3] is currently unable to determine with precision the number of customers affected by the issues identified in paragraphs [68] to [77], but admits that it is likely to be in the thousands and may be in excess of 10,000. Monitoring and enforcement of safeguards Monitoring by [NAME_3] 79 Since at least January 2014, [NAME_3] has required [NAME_17] to submit screenshots of the subscription process for each new PDB content service to [NAME_3] for approval. [NAME_3] reviews these screenshots for compliance with its requirements for [NAME_17] in place under the Conduct Policy at the time. 80 [NAME_3] did not assess whether each subscription process submitted by an [NAME_17] complied with all of [NAME_3]'s requirements, including the requirement under the Conduct Policy for [NAME_17] to comply with the Mobile Premium Services (MPS) Industry Code, which requires subscription processes to include the double opt-in SMS procedure outlined at [8c)]. Monitoring by [COMPANY_38] 81 From about September 2014, [NAME_3] engaged an external third party, [COMPANY_38] ([NAME_37]), to audit and enforce compliance by [NAME_17] of [NAME_3]'s safeguards in relation to the purchase of PDB content. The process used by [NAME_37] to audit and enforce the relevant safeguards was developed and supervised by [NAME_3]. 82 Under the process set up and supervised by [NAME_3], [NAME_37] was not technically able to monitor or audit whether each [NAME_3] customer had clicked on a subscription trigger before [NAME_3] provided a customer's mobile device number (e.g. mobile phone number) or unique identifier to [NAME_17] or [NAME_18] (under the process outlined at [22]). 83 [NAME_37] monitored compliance with the standards set by [NAME_3] in their [NAME_3] (Audit Standards) which included some but not all of [NAME_3]'s requirements under the Conduct Policy. The Audit Standards did not include the requirement under the Conduct Policy for a subscription trigger to include the words "buy now" or "subscribe now". This meant subscription processes could be approved by [NAME_37] which included other words than "buy now" or "subscribe now". 84 [NAME_37]'s monitoring process involved using a mobile device to locate advertisements for PDB content and then reviewing subscription processes for compliance with the Audit Standards. This process did not include monitoring advertisements featured in applications, on which advertisements for PDB content commonly appear. 85 The monitoring of PDB subscription processes occurred on a significantly smaller scale than the monitoring of Premium SMS services. In May-July 2016 there were 350 audits of PDB subscription processes compared to 2,227 of Premium SMS. Enforcement of safeguards 86 Between October 2014 and July 2016, [NAME_37] identified over 1,750 infringements of [NAME_3]'s standards for [NAME_33], with a monthly average of 35 per cent of all PDB audits failing to pass these standards during this period. 87 Since July 2014, despite the level of infringements at [86] and the significant volume of complaints referred to above, [NAME_3] did not terminate its contractual arrangements with any of the five [NAME_17]. [NAME_3] "permanently suspended" one PDB content service expressly for non-compliance with [NAME_3]'s requirements. [NAME_3] also suspended a further seven PDB content services in June and July 2016 until at least March 2017, arranged for customers of at least four of those PDB content services to be unsubscribed, and [NAME_3] refunded 3,492 customers to the value of approximately $428,956.00. MPS Industry Code 88 [NAME_3] was at all material times a signatory to industry codes within the meaning of the CCA, including the MPS Industry Code. The MPS Industry Code is not directly applicable to the [NAME_4] but established a norm of conduct in respect of disclosure by mobile service providers to customers. 89 Unlike the process [NAME_3] has in place in relation to Premium SMS services and the other services identified at [8], at no time in the relevant period did [NAME_3] require independent verification from its customers that they had authorised [NAME_3] to apply charges for the acquisition of third party digital content to their [NAME_3] account. REFUNDS 90 During the relevant period, [NAME_3] estimates that it has provided refunds of at least $5 million to customers in relation to charges for PDB content, some of which has been recovered by [NAME_3] from [NAME_17]. [NAME_3] has also directed [NAME_17] to refund at least 28,000 [NAME_3] customers to the value of at least $400,000 in relation to PDB content charges. CESSATION OF [NAME_4] 91 In the course of resolving the [NAME_19]'s investigation, [NAME_3] committed to and has ceased offering the [NAME_4] entirely with effect from 3 March 2018. FUTURE CONDUCT 92 [NAME_3] has committed to: a. by no later than 10 weeks from the date of the making of the final orders in these proceedings (Orders), identify customers in the following groups: i. customers to whom [NAME_3] identifies as having made the Barring Representation, the Unsubscribe Representation and the Carry Over Representation (as defined in [paragraph [94]] below); ii. customers [NAME_3] identifies as having made a complaint to the TIO prior to the date of commencement of these proceedings in relation to PDB content charges for subscriptions signed up to prior to 4 December 2017; and iii. customers [NAME_3] identifies as having complained directly to [NAME_3] prior to the date of commencement of these proceedings in relation to PDB content charges for subscriptions signed up to prior to 4 December 2017; and b. communicate with and offer to refund (which communication and offer will only be made to customers who [NAME_3] has contact details for, identifies as having not already received refunds for such charges from [NAME_3] or some other party and will only need to be made once if a customer is identified under more than one of paragraphs [92(a)(i), (ii) and (iii)] above): i. in the case of the customers referred to in paragraph [92(a)(i)] above, the PDB content subscription charges incurred in connection with and impacted by the Barring Representation, Unsubscribe Representation and/or the Carry Over Representation; and ii. in the case of the customers referred to in paragraph [92](a)(ii) and (iii)] above, the PDB content subscription charges that are the subject of the customer's complaint; and c. for a period of 12 months from the date of the making of the Orders, deal directly with future complaints (including in relation to past periods) in relation to PDB content charges for subscriptions and seek to resolve those complaints in good faith, including providing refunds for PDB content subscription charges where it is apparent that the customer had unintentionally purchased and been billed for PDB content subscriptions without their knowledge or consent and so did not agree to acquire the subscription; and d. inform the [NAME_19] in writing, within 4 months of the making of the Orders, and quarterly thereafter for one year, of: i. the steps taken to identify the customers in accordance with paragraph [92(a)] above; ii. for each of the categories of customers specified in paragraph [92(a)] above – the number of customers identified; iii. in relation to paragraph [92(b)] above – the number of customers contacted, the number of customers refunded, the number of customers (if any) refused refunds and the amount of money that has been refunded; and iv. for each of the customers who complain to [NAME_3] under paragraph [92(c)] above – the number of such customers, the number of customers refunded, the number of customers (if any) refused refunds and the amount of money that has been refunded. ADMISSIONS 93 As a result of complaints received from [NAME_3]'s customers and through a number of internal studies in relation to the [NAME_4], [NAME_3] was aware from early 2015 to at least June 2016 that the operation of the [NAME_4] had led to a significant number of its customers unintentionally purchasing and being billed for PDB content subscriptions without their knowledge or consent and so had not agreed to acquire the subscription (Non-consenting Customers). In these circumstances, by applying charges to those customers' accounts in respect of their purported subscriptions prior to 7 June 2016, when in fact that purported subscription had occurred without the customers' knowledge or consent and so the customer had not agreed to acquire the subscription, [NAME_3] thereby made false and misleading representations in connection with the supply or possible supply of a "financial product" or a "financial service" within the meaning of the ASIC Act to each of the Non-consenting Customers that they had agreed to acquire those subscriptions when they had not, in contravention of section 12DB(1)(b) of the ASIC Act. 94 [NAME_3] further admits that: a. in relation to customers who requested barring of their [NAME_4] prior to 4 December 2017, [NAME_3] represented to each of those customers that they would no longer be charged for their existing PDB subscriptions on and from the date that barring was activated, when in fact that barring only applied to new PDB subscriptions from that date (Barring Representation); b. in relation to customers who had requested barring of their Premium SMS services prior to 31 May 2016, [NAME_3] represented to each of those customers that they would be able to unsubscribe from PDB subscriptions by sending "STOP" to the applicable number, when in fact their Premium SMS barring prevented them from doing so (Unsubscribe Representation); c. in relation to customers who acquired a new mobile service from [NAME_3] prior to August 2016 and whose mobile number was deactivated for a period prior to them acquiring their service, [NAME_3] impliedly represented to each of those customers that they would not be billed for PDB subscription charges carried over from the previously deactivated mobile service, when in fact some customers were billed for those carried over PDB subscription charges (Carry Over Representation). 95 By making the Barring Representation, the Unsubscribe Representation and the Carry Over Representation, [NAME_3] admits that it made false or misleading representations that the [NAME_4] had performance characteristics, uses or benefits, in contravention of s.12DB(1)(e) of the ASIC Act.