Facebook v Australian Information Commissioner; hearing in the High Court tomorrow 7 March 2023

March 6, 2023 |

The Australian Information Commissioner chose a tough nut to crack when it chose to use for the first time its civil penalty powers against Facebook arising out of the use of personal information by Cambridge Analytica.  The Information Commissioner was late in bringing enforcement action against Facebook, The Facebook disclosed personal information to Cambridge Analystica between March 2014 and May 2015.  The Commissioner opened an investigation in April 2018 and commenced proceedings on 9 March 2020.  By then the FTC, on 24 July 2019 imposed a $ 5 billion penalty on Facebook while the UK Information Commissioner imposed a £500,00 fine on Faceook on 30 October 2019. 

On 9 April 2020 the Information Commissioner sought under rule and rule 10.43(2) leave to serve documents on Facebook, Inc. and Facebook Ireland in accordance with art 5 of Hague  Convention by substituted service. On 22 April 2020 His Honour Justice Thawley  made orders  that the Commissioner be granted leave to serve the documents in the United States of America. On 6 May 2020 Facebook Inc by interlocutory application sought to set aside those orders. Thawley J dismissed the application on 14 September 2020 and Facebook appealed that decision on 28 September 2020 to the Full Court of the Federal Court. 

The Full Court dismissed the appeal on 7 February 2022. On 16 September 2022 the High Court granted Facebook leave to appeal. It has been a long road, almost 3 years since commencing proceeding. And the case has barely begun.

The issue before the High Court is whether under Rule 10.43 of Federal Court Rules 2011 whether the Information Commissioner was successful in establishing prima facie case on application to serve appellant out of jurisdiction and whether Facebook “carr[ied] on business in Australia” within meaning of 5B(3)(b) of Privacy Act and whether it “collected… personal information in Australia” within meaning of s 5B(3)(c) of Privacy Act.

The Appellants and First Respondent filed detailed and densely argued submissions which will not be recited at length here.  It is however worth noting a number of points raised.

Facebook submits that:

  • the issues are:

(a) Can a foreign corporation “carry on business” in Australia (within the meaning of s 5B(3)(b) of the Privacy Act 1988 (Cth) (the Act)) if it has no commercial activities or other recognised indicia of carrying on business in this country? Appellant contents that hte answer is“no”.
(b) Does the requirement of a “prima facie case” in r 10.43(4)(c) of the Federal Court Rules 2011 (Cth) (Rules) require evidence that could itself support inferences sufficient to establish the cause of action, or is it enough to show only that there is a controversy as to those matters? The Appellant contends that only the former suffices.

  • regarfding carrying on business Facebook submits:
    • “carrying on business” in s 5B(3)(b) of the Act expresses the jurisdictional nexus which Parliament requires in order to connect a putative defendant with Australia as the country asserting jurisdiction.? The expression “carrying on business” has an ordinary meaning, informed by a considerable body of jurisprudence in England and Australia.?
    • To understand its meaning, as it appears in s 5B(3)(b) of the Act, it is necessary to have regard to that jurisprudence; because, where Parliament deploys a phrase with a settled judicial construction, it can be taken to have adopted that construction.*
    • the High Court  Court clarified that the territorial concept of “carrying on business” in its ordinary meaning requires the identification within the relevant territory of at least “a succession of acts”or “some repetitive act in trade”,”! which are “undertaken as commercial enterprise in the nature of going concern, that is, activities engaged in for the purpose of a profit on a continuous and repetitive basis”.
    • the statutory test is “carrying on business” in Australia. Whilst “carrying on” requires repetitive acts,” it is not the case that any class of repetitive “acts” compels the conclusion that what is carried on is a “business” within the jurisdiction.”*
    • It is the “commerciality” of the “acts” that is necessary to characterise them as being done in the carrying on of a business. What is not sufficient are:
      • commercial acts which are insufficiently connected to the carrying on of the business are not enough
      • that repetitive non-commercial acts are insufficient.
    • commerciality is essential to the ordinary meaning of a “business”. The essence of “business” is to win custom and to conclude transactions with the customers so won. That is why a business’s goodwill is the “attractive force which brings in custom’.
  • the Full Court erred in:
    • the Full Court held that the Appellant performed two kinds of activity in Australia:
      • installing “cookies” on the computers of Australian users (who were customers of Facebook Ireland), and
      • providing the “Graph API” to Australian App Developers (who were in contractual relationship with Facebook Ireland, not the Appellant)

the  lack of any “commercial quality” to the acts done here should have been fatal to the
Commissioner’s prima facie case.

    • the test stated by Perram, that if a company engages in repetitive non-commercial acts in Australia, it will conduct business here. was wrong.  It is too rigid and changes the statutory language  from “carrying business” to “engaging in repetitive acts”.
    • the demonstration of a “prima facie case” requires an applicant to place before the Court material which is capable, in its own right, of supporting the findings of fact necessary for the relief sought. It is necessary to show that those findings could be made on the material before the Court. If applicant seeks to demonstrate the existence of a “prima facie case” by way of mere inferences, then it must place before the Court evidence that, if accepted, would make it reasonably probable that the fact to be inferred exists. It is not sufficient to adduce evidence that raises the existence of the fact as a mere speculative possibility.
    • resorting to conjecture, rather than available inference, finding cookies collected personal information subject of these proceedings.  There was no evidence capable of establishing or supporting inference about how cookies work, how cookies relevant proceedings work, how cookies could work relation information subject of proceedings. Perram J seemed to rely on his own conceptions about how the Internet works; assuming without evidence that, for example, the Appellant “installs executable computer and executed”  rather than requiring the Commissioner to adduce evidence to support that position. That assumption was unavailable on the evidence & incorrect.

The Commissioner submitted:

  • In relation to the constructional question:
    • that for an entity to be carrying on business in Australia it is sufficient if there are acts within Australia that amount to, or are ancillary to, transactions that make up or support the entity’s business (wherever those transactions occur).
    • the phrase does not require “usual elements” of physical activity in Australia through human instrumentalities, or that the acts within the relevant territory are themselves intrinsically commercial .
    • the evidence established two key activities the appellant performed in Australia:
      • installing, operating andremoving cookies on Australian users’ devices,
      • providing the Graph Application Interface API) to Australian app developers supported (indeed, were integral to) the appellant’s commercial pursuits, including as part of its business of providing data processing services to Facebook Ireland:
  • regarding the prima facie case the test is whether, on the material before it, inferences were open which, if translated into findings of fact, would support the relief claimed
  • The Full Court got it right because:
    • The construction of the phrase “carries on business in Australia” that was adopted in Valve is an appropriate construction to give to the same statutory phrase as used in s 5B(3)(b) of the Act, it being suitably flexible and capable of capturing modern business practices in both statutory contexts.
    • the installation, operation and removal of cookies on the devices of Australian users and the provision of the Graph API to Australian app developers – were repetitive acts designed to advance the  appellant’s commercial enterprise,
    • where there are repeated activities occurring in Australia, then so long as those acts amount to, or are ancillary to transactions which make up or support the business of the foreign corporation (wherever those transactions occur, and whether they be monetary or non monetary that foreign corporation is “on business in Australia”.

By way of Reply Facebook submitted:

  • The question is  how to apply the statutorycriterion (“carries on business in Australia”) in the context online service providers. The Full Court attempted to answer that question via a flawed test which the Commissioner does not seriously defend
  • that “carrying on business” requires commercial indicia: not “physical” indicia, is a straw man that the Commissioner keeps attacking, despite repeated disavowals.
  • that the Commissioner ignored the principle that Parliament is taken to have adopted the settled construction of a pre-existing statutory phrase and  insists that the Privacy Act 1988 (Cth) creates its own special context for the application thecriterion.  The reliance on Valve is misplaced: it was a case
    overflowing commercial indicia (AS[15]), all which are lacking here
  • The group’s corporate structure, and the distinct legal personality of its members, cannot be brushed aside.

Leave a Reply

Verified by MonsterInsights