What you need to know:

• Between May 2014 and May 2015, 53 Australians downloaded the ‘This Is Your Digital Life’ app. It collected data from 311,127 people down under.
• That data was allegedly subsequently disclosed to Cambridge Analytica, which the Information Commissioner say was a violation of Australia’s Privacy Act.
• The Commissioner started proceedings in March last year, but the case has been sidetracked by an important issue: whether Facebook’s parent company, Facebook Inc, should be included.
• Facebook Inc lost their first case to be excluded from the case after a Judge found they did, indeed, “carry on business” in Australia through cookies and caching servers.
• Facebook Inc has appealed the decision, claiming “substantial injustice” and that the decision fundamentally changes how internet companies act under the Privacy Act.

Any company that has a website accessible from Australia could be at risk of privacy litigation, per Facebook, as it defends its role in the mass breach that saw hundreds of thousands of Australian users’ data shared with Cambridge Analytica.

In a court battle that demonstrates Australian regulators’ pursuit of more serious penalties for privacy breaches, the Office of the Australian Information Commissioner (OAIC) is taking legal action against Facebook Ireland and Facebook Inc, the platform’s US parent company.

The case comes after the data of 311,127 Australians was shared with Cambridge Analytica. It was gathered through a personality quiz app called ‘This Is Your Digital Life’. Just 53 people downloaded the app in Australia.

The OAIC has accused Facebook of serious and repeated breaches of the Privacy Act by leaving users exposed to having their data sold and “used for purposes including political profiling, well outside users’ expectations.”

The original case, which was filed in March last year, has stalled as Facebook appeals a decision by a Federal Court judge to allow the OAIC to bring the case against both Facebook Ireland and Facebook Inc.

Facebook Inc insists it should not be a party to the case.

In a full Federal Court hearing on Friday, Noel Hutley SC, acting for Facebook Inc, argued there was no evidence his client did any work in Australia. The September decision risked changing how all digital businesses interacted with Australia, he said.  

“We have no contracts here, no customers here, the contract we performed was a contract in Ireland. Our business and infrastructure is in Ireland,” per Hutley.

“If that amounts to carrying on business in Australia, then the world is carrying on business in Australia. All the cases that involve the internet must be wrong. All one can say on the evidence is what I’ve just said.”  

Leaky plumbing

In September 2020, Justice Thomas Thawley ruled that Facebook Inc did collect and store information in Australia through local caching servers and the installation and operation of cookies on Australian devices.

Facebook Inc has appealed the decision, saying the judgment was based on “important errors of principle, requiring correction by this Court”.

In court last week, Ruth Higgins SC, representing the OAIC, said Facebook’s very business model was built on collecting data. Facebook is “not a plumbing business in Woolloomooloo, it’s a quintessentially global activity”, she said.

“The applicant’s business is collecting and holding personal information to generate revenue from advertising,” she said.

“The activity of installing cookies on Australian devices is inextricably linked with the manner in which Facebook Inc maintains custom. The stated purpose of installing cookies is to enhance the service and localisation of its content.”

She said the Privacy Act “could apply to the plumbing business in Woolloomooloo, but its role is not collecting, disseminating information.”

Hutley, acting for Facebook, said the ruling risked opening the “floodgates” of litigation under the privacy act.

“Until this case, no-one has ever suggested one ‘carries on business’ merely by carrying out an act overseas with an impact in Australia,” Hutley said.

“We did no act in this country, we did all our acts overseas, they had digital effects in Australia. We say that is not carrying on business in Australia.”

Higgins dismissed the ‘floodgates’ argument brought by Facebook, insisting this case is unique to the structure and actions of Facebook.

“It treats with undue homogeneity the corporate structures of an international corporation,” she said.

“We submit the evidence furnished, first the applicant undertook data processing activities, which included installing and operating cookies … it is tolerably, plainly open that cookies are an important operation of the applicant’s operation and cannot be relegated to ancillary to the operation of the business.”

At one stage of the hearing, Justice Nye Perram asked Hutley, acting for Facebook Inc: “You collect information, don’t you?”

Hutley replied: “If one says ‘collects’, that’s its own vexed issue. It’s alleged we have information. Whether we collect it in Australia is in the case.”

Justice Perram also asked: “What about the cookies?”

Hutley replied: “It’s some form of electronic data or small program, I don’t really care. A piece of data. It’s very unclear exactly what they are. All that happens is my client is responsible for their installation and supervision.”

The federal court will make a ruling about whether to uphold or reject Facebook’s appeal at a later date.

Broader view

This case comes as regulators are understood to be taking a tougher line on social media giants. Likewise, the Privacy Act is currently being reviewed by the Attorney General’s Office.

Last month, the Federal Court ruled Google misled consumers about location data. In fact, it was the same Justice – Justice Thomas Thawley – that ruled in favour of the OAIC against Facebook Inc that ruled in favour of the ACCC.

After that case, the ACCC’s Rod Sims spoke to Mi-3 and noted that “penalties are going up”, and that – in the case of Google – “we obviously think a high penalty is appropriate if we can get it”. Sims also said there was a “huge gulf” between what the industry collects in data versus what the consumer understood.

A spokesperson for the ACCC said the regulator and Google were providing consent orders to the court “reflecting the conclusions reached by the Court and appropriate further steps”.

A date for the penalty hearing has not yet been set.