The fallout from Facebook’s Cambridge Analytica scandal continues to make its way through the Federal Court system, with the latest development confirming Facebook’s US-based entity will need to defend alleged Australian privacy breaches.
In March 2020, we reported that the Office of the Australian Information Commissioner (OAIC) had brought action against Facebook Inc (Facebook USA) and Facebook Ireland Limited (Facebook Ireland) in the Federal Court, alleging serious or repeated contraventions of the Privacy Act 1988 (Cth) (Act) associated with Cambridge Analytica’s ‘This Is Your Digital’ life app.
The OAIC alleges that Facebook USA and Facebook Ireland breached the Act’s Australian Privacy Principles (APPs) by:
- disclosing personal information in a manner contrary to APP 6; and
- failing to take reasonable steps to protect users personal information, contrary to APP 11.
In April 2021, we then reported that the Federal Court had permitted the OAIC to serve its claim on Facebook USA and Facebook Ireland, notwithstanding that they were located outside of Australia, finding:
- ‘Facebook Inc and Facebook Ireland are “organisations” for the purposes of the Privacy Act’;
- ‘the material was sufficient to establish a prima facie case that Facebook Ireland and Facebook Inc collected personal information in Australia’; and
- ‘A sufficient prima facie case on the basis articulated by the Commissioner has been shown… to warrant service outside of Australia. ..[T]hat is not to say anything about the strength of the case. Rather, the material demonstrates a genuine argument about contravention, sufficient to justify causing the respondents to be subject to the litigation in Australia where the merit of that argument can be judicially determined.’
Facebook USA appealed this decision to the full bench of the Federal Court, trying to claim that Facebook Ireland was the only entity responsible for operation of Facebook in respect of Australian users. Per Justice Perram:
At the heart of the issues which fall for decision is the fact that whilst the social network known as ‘Facebook’ appears to its users to be a single object unaffected by international borders, it is in fact principally provided by two different entities. One of these is Facebook Inc itself which provides the Facebook platform to users located in North America. The other is an Irish subsidiary of Facebook Inc, Facebook Ireland Limited (‘Facebook Ireland’), which provides the Facebook platform to users located anywhere in the rest of the world.
Notwithstanding that Facebook USA argued that any issues should be with Facebook Ireland exclusively, the Full Court considered the way in which Facebook’s platform was operated and decided that Facebook USA appears to have at least some role in respect of Australian users.
While the Full Court declined to consider whether ‘Facebook Ireland and Facebook Inc were in truth conducting a single business which was the Facebook platform’, it did find:
The primary judge was correct to conclude that an inference was available that Facebook Inc was carrying on business in Australia and that it collected in Australia the personal information which is the subject of the Commissioner’s case under APP 11. There was therefore a prima facie case that an Australian link was present and therefore that the Privacy Act applied to extra-territorial conduct by Facebook Inc.
In reaching this conclusion, the Court gave judicial consideration to some the technical measures employed in operating the platform, including browser cookies and caching servers.
The Court also gave perhaps the most senior judicial consideration to date of key notions from the Act and the APPs, including fundamental concepts like what it means for an entity to ‘collect’ and ‘hold’ personal information.
The Full Court’s decision is only that there is a sufficiently arguable case against Facebook USA that the case proper should proceed. With the substance of the matter still to properly litigated, there is still plenty to play out in this matter before it is resolved, particularly given these early indications that Facebook will vigorously defend its case.
This article was written by Luke Dale, Partner and Daniel Kiley, Special Counsel.
