In a recent decision, the Full Federal Court upheld an earlier decision that held that there was a prima facie case that Facebook Inc had an ‘Australian link’, bringing it within the scope of the Privacy Act.
The decision enables the Australian Information Commissioner to progress with its landmark proceedings against Facebook in relation to alleged breaches of the Australian Privacy Principles.
Background to the proceedings
The case of Facebook Inc v Australian Information Commissioner  FCAFC 9, relates to earlier proceedings commenced by the Commissioner in response to Facebook Inc and Facebook Ireland’s involvement in the ‘Cambridge Analytica’ scandal. In April 2020, the Federal Court granted the Commissioner leave to serve its initiating court documents on Facebook Inc overseas, finding that the Commissioner had a prima facie case that Facebook Inc had an ‘Australian link’ within the meaning of section 5B(3) of the Privacy Act 1988 (Cth).
Facebook Inc then brought an interlocutory application in the Federal Court to set aside the overseas service. The Court dismissed the application, upholding its earlier decision.
Facebook Inc appealed this decision to the Full Federal Court, arguing that the primary judge erred in finding that there was a prima facie case that Facebook Inc had an ‘Australian link’. In order to determine this issue, the Full Court was required to consider whether Facebook Inc (prima facie):
- carried on business in Australia
- collected or held personal information in Australia.
Did Facebook Inc carry on business in Australia?
The Full Court held that there was a prima facie case that Facebook Inc ‘carried on business’ in Australia by:
- installing and managing cookies on the physical devices of Australian users
- providing certain functionality to Australian developers through its Graph API.
Importantly, the Full Court rejected Facebook Inc’s argument that it was not carrying on a business in Australia because it had no physical assets, customers or revenues in Australia.
The Full Court held that Facebook Inc did not need a physical presence in Australia in order to carry on business in Australia within the meaning of section 5B(3) of the Privacy Act. The Full Court considered that this position was supported by the objects of the Privacy Act and section 5B(3)(c), which indicates that the focus of the Privacy Act is the enforcement of the Australian Privacy Principles in relation to the collection or holding of personal information.
Did Facebook Inc collect or hold personal information in Australia?
The Full Court held that there was a prima facie case that Facebook Inc collected personal information by installing cookies on Australian users’ devices.
The Full Court reasoned that Facebook Inc’s documents suggested that the cookies were involved in the process of targeted advertising, and it could be inferred that those cookies were used for collecting personal information.
Given that there was a prima facie case that Facebook Inc carried on business and collected personal information in Australia, the Full Court was satisfied that Facebook Inc had an ‘Australian link’ and was subject to the Privacy Act.
Importance of the decision
The decision clarifies that entities do not need to have any physical presence in Australia in order to carry on a business in Australia. Overseas entities operating online businesses that carry on business and collect or hold personal information in Australia should consider whether they are now caught by the Privacy Act.
Please contact a member of our corporate advisory team if you would like any assistance with privacy compliance.