Express law No. 305

17 February 2022

Federal Court rejects Facebook appeal, finds that Privacy Act may apply to companies with no physical presence in Australia

Facebook Inc v Australian Information Commissioner [2022] FCAFC 9 (7 February 2022).

Implications

This case provides useful guidance on the Privacy Act 1988, including on the scope of ‘holding’ personal information. However, its main relevance is the Full Court’s approach to the test of ‘carrying on business’ in Australia. The Court has clarified that, in the right circumstances, a company may be carrying on business in Australia even where it has no physical presence here.

This recognises the realities of many modern businesses which trade in and monetise the intangible, and is an important step forward for regulators dealing with such companies.

Background

These proceedings concern the Facebook–Cambridge Analytica data scandal that occurred in the 2010s, and became public knowledge in 2018.

In 2020, the Australian Information Commissioner commenced proceedings against Facebook Inc (now renamed Meta) and its subsidiary Facebook Ireland (together, Facebook) alleging that Facebook had contravened Australian Privacy Principles 6 and 11.

Facebook Inc applied to the Federal Court seeking to set aside orders permitting overseas service on the basis that the Commissioner did not have a prima facie case. This application was dismissed at first instance, and Facebook Inc appealed to the Full Court.

Reasoning

The Full Court dismissed Facebook Inc’s appeal. In determining whether the Commissioner had a prima facie case, the Full Court considered the application of s 5B of the Privacy Act 1988, which extends the application of the statute to acts done or practices engaged in outside Australia if they are done or engaged in by an organisation that has an Australian link.

The first limb of the ‘Australian link’ test in s 5B(3) requires the organisation to be carrying on a business in Australia. Perram J (with Allsop CJ and Yates J agreeing) found there to be a prima facie case that Facebook Inc carries on business in Australia in 2 ways:

• by installing and removing cookies on users’ devices in Australia that help deliver targeted advertising to users on the Facebook platform
• by managing the Graph Application Programming Interface, through which apps could request personal information from users’ Facebook accounts.

Importantly, the judges agreed that Facebook Inc need not have a physical presence in Australia in order to carry on business in Australia. This is because of the legislative framework created by the Privacy Act 1988, and the realities of modern tech companies. Perram J considered that the Privacy Act 1988 is, at its core, about the non-material concept of information, and so it was reasonable that its application may extend to the non-material presence of businesses – particularly where, as here, the business was not manifested in physical matter but in the monetisation of information: [70]-[75].

Allsop CJ agreed, adding that the nature of Facebook Inc’s business is fundamental to all enquiries that concern it. Allsop CJ also observed that, while some of Facebook Inc’s activities in data collection and processing may appear to lack a commercial quality, they take their place as a material part of the working of the business. Their commerciality must be considered in that context: [3], [8]-[9].

The case is a useful exposition of the concept of carrying on a business.

The second limb of s 5B(3) requires that Facebook Inc was collecting or holding in Australia the personal information that is the subject of the claim. Perram J held that the inference was open that Facebook Inc collected personal information in Australia, because of the use of cookies installed on users’ devices: [135]-[143]. While his Honour did not find that Facebook Inc prima facie held users’ personal information in Australia, he did make the observation that the concept of ‘possession’ under the Privacy Act extends not only to physical possession but also a ‘right to possession’: [155].

(Note: the Full Court’s decision deals only with the preliminary issue of service of proceedings abroad on Facebook Inc, and the substantive proceeding remains to be heard.)

Read the Full Court’s decision in:  Facebook Inc v Australian Information Commissioner [2022] FCAFC 9 (7 February 2022)