The risks of taking a ‘set and forget’ approach to ACL compliance

Articles Written by Sar Katdare (Partner), Morgan Blaschke-Broad (Senior Associate), Andrew Kish (Associate)
Rushing lights

Last week’s Federal Court decision in ACCC v Uber highlights the risks associated with taking a ‘set and forget’ approach to regulatory compliance, particularly when relying on automated processes, and serves as a reminder of the Federal Court’s willingness to intervene over agreed penalties for contraventions of the Australian Consumer Law (ACL).


In April 2022 the ACCC commenced proceedings against Uber B.V. (Uber) for misleading and deceptive conduct and false and misleading claims in relation to Uber displaying:

  • fares (as a range) that overestimated the price of UberTaxi trips (UberTaxi representations); and
  • a message warning consumers that they may be charged a small cancellation fee after selecting the “Cancel Trip” option when no such fees were applicable under the relevant terms and conditions (Cancellation representations).

These representations were generated from Uber’s automated systems and in some cases were generated and controlled by other Uber entities. As a result of their automation, they were displayed to a very large number of consumers over a prolonged period of time.

Uber and the ACCC filed a statement of agreed facts and admissions, and proposed orders to resolve the matter for a penalty of $26 million. Despite the agreement between the parties, the Court considered the proposed penalty “outside the range” of appropriate penalties in the circumstances and described the evidence adduced in support of the proposed sum as “grossly inadequate[1]. At that time the Court considered a penalty in the order of $4-6 million would be more appropriate, and invited the parties to provide further evidence in support of the penalties they were seeking.

Despite the Court finding that the parties’ further submissions failed to “adequately explain how the [penalty] figures had been arrived at” and a lack of discernible harm caused to consumers, due to the scale of the contravening conduct the Court ultimately ordered that Uber pay $21 million in penalties and contribute $200,000 to the ACCC’s costs.

The Court observed that there were a “very large” number of contraventions over a “lengthy period of time” resulting from:

  • 7.49 million Cancellation representations during a period of almost 4 years (comprising 7.39 million UberX, Uber Premier or Uber Comfort and 74,559 UberPool bookings);[2] and 
  • 114,679 UberTaxi representations during just over 2 years[3].

The Court also found that, although the conduct caused only “modest loss or damage to consumers” and was largely the result of automated messaging, this did not absolve Uber of liability. In fact, the Court found that Uber had failed “to take steps to ensure the cancellation messaging was accurate and not misleading” and that this was “an important circumstance in determining the penalty” in the amount ordered.


This case is a reminder that going to market with information generated from automated systems or third-party sources without adequate monitoring may risk:

  • inadvertent and ongoing breaches of the ACL;
  • regulatory scrutiny, investigation or legal proceedings;
  • cumulative liability (especially for high volumes of customer transactions / interactions) for multiple contraventions over a long period of time; and
  • exposure to significant and cumulative statutory maximum penalties.

This decision also highlights the Court’s willingness to intervene where parties have agreed penalties, especially where the Court considers that neither party has provided sufficient evidence in support of the agreed outcome.

What can you do?

Actively monitor technology outputs

Taking a ‘wait and see’ or ‘set and forget’ approach to automated procedures, or automatically generated information risks far reaching and long-running regulatory non-compliance going unchecked. It is important to ensure systems are in place to actively monitor and audit the accuracy of any representations made to consumers (or the market), especially when based on information derived from automated systems or third-party sources. This is even the case where it appears unlikely that the conduct will result in significant or any consumer harm.

Automation is not a defence to ACL contraventions and will not protect companies from significant penalties. To avoid inadvertently breaching the ACL (or other applicable laws and regulations), it is important to maintain ACL (or other applicable) risk monitoring, compliance and training programs that are up-to-date and fit for purpose.

Be proactive to avoid the unknown and potentially unlimited costs of non-compliance

It is critical for organisations to maintain a good understanding of the ACL and wider regulatory compliance obligations so they can identify and address business activities that pose a compliance risk generally, and those that are capable of attracting potentially unlimited penalties.

In addition to financial penalties, failing to comply with obligations also risks reputational damage, given the publicity that usually accompanies ACCC proceedings.

Consider your approach to regulator engagement

This decision highlights the need to be adaptive and thorough in your engagement with a regulator. It is likely that as a result of the Court’s criticism over the adequacy of information provided, and the lack of evidence of real consumer harm, the ACCC will require more comprehensive and complete supporting documentation. This is likely to have a material impact on negotiations, and any Court review of the penalties which are agreed.

It is also important to remember that any supporting materials provided to the ACCC in penalty negotiations may become public. So, before handing over documents it is wise to engage with your legal advisors, the regulator and the Court on matters of privacy and confidentiality, to ensure sensitive information is not inadvertently disclosed.

It is also worth noting, that while class action may be unlikely in this case, the risk of such proceedings must be considered when providing evidence to a regulator or putting it forward in any initial proceedings.

[1] ACCC v Uber [11].

[2] ACCC v Uber [124].

[3] ACCC v Uber [82]-[83] and [123].

Important Disclaimer: The material contained in this article is comment of a general nature only and is not and nor is it intended to be advice on any specific professional matter. In that the effectiveness or accuracy of any professional advice depends upon the particular circumstances of each case, neither the firm nor any individual author accepts any responsibility whatsoever for any acts or omissions resulting from reliance upon the content of any articles. Before acting on the basis of any material contained in this publication, we recommend that you consult your professional adviser. Liability limited by a scheme approved under Professional Standards Legislation (Australia-wide except in Tasmania).

Related insights Read more insight

Digital Bytes – cyber, privacy & data update

Welcome to Digital Bytes, our latest quarterly update on current developments in cyber, privacy and data governance.

Recent trends in ACCC SOI informal merger clearance decisions

We are pleased to share with you the 8th edition of our report on recent trends in informal merger clearance decisions made by the Australian Competition & Consumer Commission (ACCC) that involve a...

Australia's merger control mandatory in 2026

The Treasurer yesterday announced far-reaching reforms of Australia's merger control regime. The reforms proposed by the Government include the introduction of a mandatory notification requirement...