The Full Federal Court has held that the Australian Information Commissioner (Commissioner) can serve proceedings on Facebook Inc, incorporated in Delaware and based in California. The Full Court found that there is a prima facie case that Facebook conducted business, and held personal information, in Australia.
Background to proceeding
The Commissioner issued proceedings in the Federal Court against Facebook Inc and Facebook Ireland Limited in March 2020, alleging the social media platform committed serious and/or repeated interferences with privacy in breach of the Privacy Act 1988 (Cth) (Privacy Act) in connection with the Cambridge Analytica scandal (we’ve previously covered the background here). The Commissioner had obtained leave to serve the initiating documents on the US-based entity in April 2020.
Facebook Inc made an application to the Federal Court to set aside the decision granting leave for the documents to be served. In September 2020, Justice Thawley dismissed Facebook Inc's application, having been satisfied that the Commissioner had established a prima facie case that Facebook Inc was carrying on a business in Australia.
Facebook Inc appealed Justice Thawley's decision to the Full Court, arguing that it was not carrying on a business in Australia.
What does the Privacy Act say?
The Privacy Act applies to entities outside of Australia provided that there is 'an Australian link' (as defined in section 5B of the Privacy Act). An 'Australian link' will be established if the entity:
- carries on a business in Australia; and
- collects or holds personal information in Australia, either before, or at the time of, handling the personal information.
Issues in the proceeding
By way of context, Facebook's app, This is Your Digital Life, collected data from Facebook users who used the app, as well as those users' Facebook contacts. The Commissioner alleges that data was later used and disclosed for other purposes, of which users were not aware, and to which they did not consent. Facebook collected the personal information of 311,074 Australians in connection with the app.
While the proceeding concerned both Facebook Inc (which provides Facebook to North American users) and Facebook Ireland (which provides Facebook to users in all other countries), Justice Perram (who delivered the main judgment of the Full Court) considered only Facebook Inc's activities. The nature of Facebook Inc's business was considered to be providing data processing services to Facebook Ireland.
Facebook Inc argued that the company could not be conducting business in Australia, and that only Facebook Ireland was conducting business. The Full Court rejected this argument. At a prima facie level, the Data Processing Agreement between Facebook Inc and Facebook Ireland was evidence that Facebook Inc was conducting business in Australia.
Facebook Inc also submitted that it had no physical assets, customers or revenues in Australia. The Full Court did not accept this submission. Justice Perram drew on the Explanatory Memorandum to the Privacy Act, which accompanied the introduction of section 5B. The Explanatory Memorandum expresses Parliament’s intent that the Privacy Act should apply to entities ’who have an online presence (but no physical presence in Australia), and collect personal information from people who are physically in Australia’.
Justice Perram and Chief Justice Allsop both observed the importance of context in determining the meaning of 'carrying on a business' from case to case. Justice Perram held that 'the concept of carrying on a business, must … take its shape from the business being conducted.' Chief Justice Allsop echoed this sentiment, stating that 'the proper characterisation of [the activity] is to be approached by reference to the nature of the business and the place of [the activity] within the business, and the context as to why the question is being asked, being here the operation of a statute concerned with [privacy].'
Although Facebook had argued that the installation of cookies did not provide a sufficient nexus to be considered 'carrying on a business' in Australia, the Full Court did not accept this submission. While the Full Court did find that it is not automatically the case that an organisation that simply makes a website accessible in Australia will be considered to be 'carrying on a business' in Australia, the Full Court did again point to the importance of context.
The Full Court determined that, for a digital business like Facebook, the relevant context is that Facebook Inc installs and removes cookies in Australia, and also manages a login system for Australian developers that is widely used in Australia. These factors provided a sufficient prima facie basis for Facebook Inc to be considered as ‘carrying on a business in Australia’.
The Full Court noted that the primary judge erred in deciding that Facebook Inc held personal information. However, the Full Court agreed with the primary judge that Facebook Inc did indeed collect personal information, so this was not material to outcome.
The result of the judgment was that service on Facebook Inc by the Information Commissioner was not set aside.
What's next?
The appeal decision provides useful guidance for organisations that operate overseas as to the meaning of the phrase 'carrying on a business in Australia', and the importance of considering the broader context of their activities in Australia.
It is now expected that the substantive matters in the proceeding will be able to be ventilated. The case is particularly significant because it is the first penalty proceeding under the Privacy Act which will consider whether an organisation’s actions (in this case, Facebook) amounted to a serious and/or repeated interference with Australians’ privacy.
MinterEllison provides full-service IT legal and consultancy services, with extensive experience in privacy, data protection and software and IT service procurement.
Please contact us if you would like assistance in ensuring your organisation is meeting privacy obligations under Australian law.
