The Office of the Australian Information Commissioner’s (OAIC) proceedings against Facebook for alleged breaches of the Privacy Act 1988 (Cth) (Privacy Act) arising out of the Cambridge Analytica scandal are now one step closer to being substantively determined by the courts. However, in light of a recently recommended change to the Privacy Act’s definition of ‘personal information’, we will have to wait and see whether the final decision in the substantive proceedings – as to whether Facebook breached that legislation – may ultimately be of limited value as precedent in future Privacy Act cases as a result of the implementation of that proposed change to the law.
Background
As we have previously reported, the OAIC brought proceedings against two Facebook entities, Facebook Inc and Facebook Ireland Limited (together, Facebook), in March 2020.
The OAIC is seeking civil pecuniary penalties against Facebook for its disclosure of personal information belonging to approximately 300,000 Australian Facebook users during 2014 and 2015 to those behind an application called ‘This Is Your Digital Life’.1 The information was then sold to Cambridge Analytica, a political consulting firm, and was permitted to be used for political profiling.
The OAIC has alleged that Facebook breached two of the Australian Privacy Principles (APPs), and therefore breached the Privacy Act by seriously and repeatedly interfering with the privacy of individuals. The allegedly breached APPs are APP 6.1, which prohibits the use and disclosure of personal information for a purpose different to that for which it was collected,2 and APP 11.1, which requires that reasonable steps be taken to protect information.3
Since 2020, this matter has been progressing through the courts on the question of whether or not the OAIC was able to serve proceedings on Facebook Inc. This question arises because Facebook Inc is an American company, which means that particular requirements in the Federal Court Rules 2011 (Cth) (Federal Court Rules) had to be met before the court would allow it to be served.4
In February 2022, we reported on the Full Court of the Federal Court’s (Full Court) decision to unanimously uphold an earlier decision that Facebook Inc could be served.
High Court decisions – what do they mean?
In September 2022, Facebook Inc was granted special leave to appeal the Full Court’s decision to the High Court. However, effective January 2023, the entire Division 10.4 of the Federal Court Rules, which sets out the requirements for service of persons outside Australia, was replaced.5
Subsequently, the High Court unanimously decided that because of the changes to the Federal Court Rules, Facebook Inc’s grounds of appeal were ‘no longer of public importance’, and special leave to appeal was revoked.6
In practical terms, this revocation of special leave means that the OAIC is indeed able to serve proceedings on the American Facebook company. As such, the substantive proceedings can now progress through the court.
Key takeaways
So far, these proceedings have provided us with appellate authority which further clarifies the circumstances in which a company can be said to carry on business in Australia.7 For High Court guidance on this question, however, it may depend whether the OAIC’s substantive proceedings against Facebook end up before the High Court on appeal, which could provide the Court with the opportunity to address this issue. That could take some time, especially given how long it has already taken for these proceedings to progress to the High Court on the issue of service.
However, with the recent review of the Privacy Act already having recommended that the legislation’s definition of ‘personal information’ be changed, we will have to wait and see whether the evolution of legislation might limit the value of the final decision in these proceedings as a precedent for future cases concerning the APPs.
The changes to the Federal Court Rules have made the requirements for serving Federal Court proceedings on companies outside of Australia less onerous.8 Although this could result in overseas companies being more exposed to proceedings in the Federal Court, it is worth noting that the recent changes to the Federal Court Rules have brought these Rules into alignment with the rules that apply in most other Australian jurisdictions.9
This article was written by Jonathan Parsalidis, Law Graduate and edited by Peter Campbell, Partner and Daniel Kiley, Partner.
1Australian Information Commissioner v Facebook Inc (No 2) [2020] FCA 1307, [5] (AIC v Facebook (No 2)); Australian Information Commission v Facebook Inc (2020) 144 ACSR 88, [1] (AIC v Facebook); Facebook Inc v Australian Information Commissioner (2022) 289 FCR 217, 222 [18] (Facebook v AIC).
2Privacy Act sch 1 cl 6.1.
3Privacy Act sch 1 cl 11.1.
4See Federal Court Rules, rr 10.42–10.43 (as at 2 May 2019).
5Federal Court Legislation Amendment Rules 2022 (Cth) r 2(1), sch 1 cl 13.
6Facebook Inc v Australian Information Commissioner [2023] HCATrans 22 (7 March 2023) (High Court Transcript).
7See Facebook v AIC, [93]-[103].
8See also New rules on service outside Australia for the Federal Court of Australia – Conflict of Laws
9High Court Transcript. See Federal Court Rules div 10.4.
