Peter A Clarke

The Federal Court today dismissed an application by Facebook against a previous ruling granting the Australian Information Commissioner leave to serve legal documents on Facebook USA.

The issue in the application was Facebook contending that it did not carry out business in Australia.

The terms of the application and the supporting affidavit are not publicly searchable, yet. The hearing took place on 6 May 2020.

The orders of Justice Thawley are:

1. The interlocutory application dated 6 May 2020 be dismissed.
2. The written reasons for judgment not be published beyond the parties until further order.
3. The parties have until 12 pm on 16 September 2020 to advise the Court of any orders for redactions sought, together with a concise written explanation as to why those redactions ought be made.
4. Unless any party applies within 7 days for a different order with respect to costs, the first respondent pay the applicant’s costs of the interlocutory application.

The Commissioner had a restrained crow about the result in a media release providing:

The Federal Court today rejected Facebook Inc’s application to set aside the Court’s earlier ruling granting the Australian Information Commissioner leave to serve legal documents on the US-based entity.

The Commissioner filed proceedings against Facebook Inc and Facebook Ireland in the Federal Court in March, alleging the social media platform committed serious and/or repeated interferences with privacy in contravention of Australian privacy law. The Commissioner subsequently applied for and obtained leave to serve the initiating court documents on Facebook Inc and Facebook Ireland. Facebook Ireland did not apply to set aside service.

In the ruling released today, Justice Thawley was satisfied that the Commissioner had established a prima facie case that Facebook Inc was carrying on business in Australia, and was collecting and holding personal information in Australia at the relevant time. While these matters remain to be established at trial, the Court held the matters were sufficiently arguable to justify service outside of Australia and subjecting Facebook Inc to proceedings in Australia.

Australian Information Commissioner and Privacy Commissioner Angelene Falk welcomed today’s decision and said her office would continue to move forward with the case.

The decision has little to do with the key matters in controversy, the use and misuse of personal information collected by Facbook by Cambridge Analytica.

The Guardian in Facebook suffers blow in Australia legal fight over Cambridge Analytica provides a very useful summary of the facts surrounding the case.  I covered the same ground in earlier posts in April and March with the main focus on the legal issues.

The article provides:

The Australian privacy regulator’s case accuses Facebook of serious and repeated breaches of privacy law, saying its actions left the data of about 311,127 Australian Facebook users exposed to being sold and “used for purposes including political profiling, well outside users’ expectations”.

The proceedings were brought against Facebook Inc, the tech giant’s US entity incorporated in Delaware. Its other entity, Facebook Ireland Ltd, is registered in its European namesake.

Because both entities exist outside of Australia, the regulator had to convince a court it had a prima facie case that both companies carried out business in Australia and may have contravened Australia’s privacy laws.

The federal court ruled in April that such a case existed, and gave the OAIC leave to serve documents on Facebook’s US-based entity, Facebook Inc.

A month later, Facebook Inc applied to have the court’s ruling set aside.

Facebook Inc argued it did not carry out business in Australia at the time of the Cambridge Analytica scandal.

Facebook lost that argument on Monday, when Justice Thomas Thawley found against the company. Thawley is yet to deliver any reasons for his judgment.

But in a statement, the OAIC said the court was “satisfied that the commissioner had established a prima facie case that Facebook Inc was carrying on business in Australia, and was collecting and holding personal information in Australia at the relevant time”.

“While these matters remain to be established at trial, the court held the matters were sufficiently arguable to justify service outside of Australia and subjecting Facebook Inc to proceedings in Australia,” the OAIC said.

It said Facebook’s Irish entity had not applied to have the ruling set aside.

A Facebook spokeswoman said: “We are aware of the court’s decision today and we are reviewing it carefully.”

In the April ruling, the federal court said the evidence suggested that Facebook Ireland was the provider of the Facebook service to Australian users, making it responsible for the collection and storage of personal information of those users.

But it also said the evidence suggested that Facebook Ireland was providing the service to Australian users as an agent for the US-based Facebook Inc.

“The contractual relationship between Facebook Ireland and Facebook Inc is such that a prima facie case is also shown as against Facebook Inc,” the court ruled in April.

The data harvested by Cambridge Analytica was collected through a personality quiz app, named This is Your Digital Life.

Only 53 people in Australia installed the app, according to court documents. But the app was also able to access the data of friends.

The OAIC alleged the data of 311,127 Australians was exposed in total.

Each contravention of the Privacy Act brings a potential maximum penalty of $1.7m. The OAIC is alleging multiple breaches but has not indicated whether it will seek financial penalties for each affected user.

There will be many more interlocutory applications if Facebook is true to its reputation. This is a very good start for the Commissioner.