Australian Information Commission v Facebook Inc

Link copied
Case Copied 36 min read

FEDERAL COURT OF AUSTRALIA

Australian Information Commission v Facebook Inc [2020] FCA 531

File number(s): NSD 246 of 2020
Judge(s): THAWLEY J
Date of judgment: 22 April 2020
Catchwords: PRACTICE AND PROCEDURE – Alleged contraventions of s 13G of the Privacy Act 1988 (Cth) – Interlocutory Application – Application for interim suppression and non-publication orders under s 37AI of the Federal Court of Australia Act1976 (Cth) – Application for service outside of Australia pursuant to r 10.43(3) and (4) of the Rules – Application for substituted service under r 10.24 of the Federal Court Rules 2011 (Cth) – Application granted
Legislation:

Evidence Act 1995 (Cth) ss 75, 144(1)

Federal Court of Australia Act 1976 (Cth) ss 19, 21, 37AI, 37AF, 37AG

Federal Court Rules2011 (Cth) rr 10.24, 10.42, 10.43, 10.44, 10.49

Judiciary Act 1903 (Cth) s 39B(1A)

Privacy Act 1988 (Cth) ss 5B, 6, 6C, 6D, 13G, 14, 40(2), 42(2), 80W

Convention on the Service Abroad of Judicial and Extrajudicial Documents in Civil or Commercial Matters, art 5

Cases cited:

Agar v Hyde (2000) 201 CLR 552

Anchorage Capital Partners Pty Ltd v ACPA Pty Ltd (2018) 259 FCR 514

Australian Competition and Consumer Commission v Kokos International Pty Ltd [2007] FCA 2035

Australian Competition and Consumer Commission v Valve Corporation (No 3) (2016) 337 ALR 647

Australian Competition and Consumer Commission v Yellow Page Marketing BV [2010] FCA 1218

Australian Securities and Investment Commission v Axis International Management Pty Ltd [2008] FCA 1605

Bell Group Ltd (In Liq) v Westpac Banking Corporation (1996) 20 ACSR 760

Bray v F Hoffman-La Roche (2003) 130 FCR 317

Century Insurance (in provisional liquidation) v New Zealand Guardian Trust [1996] FCA 376

Commissioner of Taxation v Caratti (No 2) [2018] FCA 1500

Commissioner of Taxation v Oswal [2012] FCA 1507

Commissioner of Taxation v Zeitouni (2013) 306 ALR 603

Ho v Akai Pty Ltd (in liq) (2006) 247 FCR 205

Humane Society International Inc v Kyodo Senpaku Kaisha Ltd (2006) 154 FCR 425

Israel Discount Bank Limited v ACN 078 272 867 Pty Ltd (in liq) (formerly Advance Finances Pty Ltd) (2019) 367 ALR 71

Kosmos Capital Pty Ltd v Turiya Ventures LLC [2019] FCA 528

Laurie v Carroll (1958) 98 CLR 310

Park (Trustee) v Tschannen (Bankrupt) [2016] FCA 137

Privacy Commissioner v Telstra Corporation Ltd (2017) 249 FCR 24

Tiger Yacht Management Ltd v Morris (2019) 268 FCR 548

Date of hearing: Application heard on the papers
Registry: New South Wales
Division: General Division
National Practice Area: Commercial and Corporations
Sub-area: Regulator and Consumer Protection
Category: Catchwords
Number of paragraphs: 76
Solicitor for the Applicant: Australian Government Solicitors

ORDERS

NSD 246 of 2020
BETWEEN:

AUSTRALIAN INFORMATION COMMISSION

Applicant
AND:

FACEBOOK INC

First Respondent

FACEBOOK IRELAND LIMITED

Second Respondent

JUDGE:

THAWLEY J

DATE OF ORDER:

22 APRIL 2020

THE COURT ORDERS THAT:

1.Pursuant to s 37AI of the Federal Court of Australia Act 1976 (Cth), on the ground set out in s 37AG(1)(a), until the conclusion of the first…

CaseChat AU logo

Keep reading for free

Create a free CaseChat account to read Australian Information Commission v Facebook Inc and more:

  • Read every judgment in full
  • Ask AI and get answers linked to paragraphs
  • See how each paragraph was cited in later cases
  • Download judgments as PDF or Word
Continue with Google

One click creates your free account or signs you in.

By continuing you agree to the Terms and Privacy Policy.

Details
Case
[2020] FCA 531
Decision Date

CaseChat Overview and Summary

The Australian Information Commissioner brought proceedings against Facebook Inc and Facebook Ireland, alleging contraventions of the Privacy Act 1988 (Cth). The Commissioner sought various interlocutory orders, including interim suppression and non-publication orders, and orders for service outside Australia. The legal issues before the court included whether the Commissioner had established a prima facie case to warrant service outside Australia, and whether the court should exercise its residual discretion to order such service. The court held that the Commissioner had established a prima facie case that Facebook Inc and Facebook Ireland had contravened the Privacy Act by engaging in practices that were serious interferences with the privacy of individuals. The court also found that the Commissioner had made out the requirements for service outside Australia, and that the discretionary factors favoured the exercise of the court's discretion to order such service. The court made orders for interim suppression and non-publication, and for service outside Australia in accordance with the Hague Convention. The court also made orders for substituted service by email to the respondents' legal representatives and certain personnel.

The court's decision provides guidance on the extra-territorial operation of the Privacy Act and the factors relevant to the exercise of the court's discretion to order service outside Australia. The decision also highlights the importance of establishing a prima facie case in interlocutory proceedings, and the need for careful consideration of the sufficiency of the material adduced in such proceedings. The decision is likely to be of interest to practitioners in the areas of privacy law and international litigation.

Orders

Orders of the court

1. Pursuant to s 37AI of the Federal Court of Australia Act 1976 (Cth), on the ground set out in s 37AG(1)(a), until the conclusion of the first case management hearing at which the first and second respondents appear, or further order, the information in the following documents is not to be disclosed or published other than to the Court, the parties and their legal representatives:

(a) the following parts of Exhibit SJH-1 to the affidavit of Sophie Jane Higgins made on 9 April 2020:

(i) Tab 2;

(ii) Tab 4;

(iii) Tab 6;

(iv) Tabs 8-11;

(v) Tab 14 (parts highlighted in red on pages 340-341, 344-352);

(vi) Tab 14.1 (parts highlighted in red on pages 355-356);

(vii) Tab 14.3 (parts highlighted in red on pages 478, 480);

(viii) Tab 14.4 (parts highlighted in red on pages 481-482);

(ix) Tab 14.6 (parts highlighted in red on pages 486-489); 1.1.10. Tab 14.7 (parts highlighted in red on pages 492-493);

(x) Tab 14.8;

(xi) Tab 15 (parts highlighted in red on pages 499-501, 509-511, 536-537);

(xii) Tab 18.3;

(xiii) Tab 18.4;

(b) the confidential annexure to the statement of claim filed on 9 March 2020.

2. Pursuant to r 10.42 and r 10.43(2) of the Federal Court Rules 2011 (Cth) (Rules), the applicant be granted leave to serve:

(a) the originating application, statement of claim (excluding the confidential annexure) and concise statement filed on 9 March 2020;

(b) the interlocutory application;

(c) the affidavit of Adam Ian Zwi of 9 April 2020 (without annexures);

(d) the affidavit of Sophie Jane Higgins of 9 April 2020 (without exhibit);

(e) applicant’s written submissions of 9 April 2020; and

(f) any orders made by the Court on the hearing of this interlocutory application and any reasons for judgment, (together, Documents),

on the first respondent in the United States of America, in accordance with art 5 of the Convention on the Service Abroad of Judicial and Extrajudicial Documents in Civil or Commercial Matters, done at the Hague on 15 November 1965 (Hague Convention).

3. Pursuant to r 10.42 and r 10.43(2) of the Rules, the applicant be granted leave to serve the Documents on the second respondent in the Republic of Ireland:

(a) in accordance with art 5 of the Hague Convention; and

(b) by sending the Documents to the registered address of the second respondent in accordance with s 51(1) of the Companies Act 2014 of Ireland and art 10(a) of the Hague Convention.

4. Pursuant to r 10.24 of the Rules, the applicant may serve the Documents on the first respondent by sending the Documents by email to Ms Peta Stevenson (peta.stevenson@au.kwm.com) and Mr Luke Hawthorne (luke.hawthorne@au.kwm.com) of King & Wood Mallesons.

5. Pursuant to r 10.24 of the Rules, the applicant may serve the Documents on the second respondent by sending the Documents by email to:

(a) Ms Peta Stevenson (peta.stevenson@au.kwm.com) and Mr Luke Hawthorne (luke.hawthorne@au.kwm.com) of King & Wood Mallesons; and

(b) Ms Yvonne Cunnane of the second respondent (yvonnecunnane@fb.com).

6. The first and second respondents file a notice of address for service in accordance with r 5.02 of the Rules within 14 days after service upon them of the originating application.

Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

Background

Background to the litigation

Full text does not contain this section.

Evidence

Evidence Before The Court

Section 75 of the Evidence Act 1995 (Cth) is relevant to the assessment of the sufficiency of the material adduced, because it provides that the hearsay rule does not apply in an interlocutory proceeding, if the party adducing the evidence also adduces evidence of the source of the hearsay evidence – cf: Bray at [56] and [58] (Carr J); Yellow Page Marketing at [25] (Gordon J). The Commissioner only need establish a prima facie case in relation to one cause of action or remedy: Israel Discount Bank at [48]. Under s 13G of the Privacy Act, an entity will be liable for a civil penalty if: (a) it does an act, or engages in a practice, that is a serious interference with the privacy of an individual; or (b) repeatedly does an act, or engages in a practice, that is an interference with the privacy of one or more individuals. Whilst the Commissioner only needs to establish a prima facie case under one of these paragraphs, for the reasons given below, the Commissioner has established a prima facie case under both.C.4.2 Whether respondents are entities and organisations within the Privacy Act Section 13G of the Privacy Act focuses on acts or practices of “entities”. An “entity” is defined as including an “organisation” which is defined as having the meaning in s 6C: s 6(1). The extra-territorial operation of the Privacy Act relevantly depends on whether the respondent is an “organisation”: s 5B(1A). An organisation includes a body corporate “that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory”: s 6C(1). A body corporate is not a small business operator if it carries on a business that has an annual turnover of more than $3 million: s 6D(4). I am satisfied that Facebook Inc and Facebook Ireland are “organisations” for the purposes of the Privacy Act.C.4.3 Extra-territorial operation of the Privacy Act Section 5B of the Privacy Act includes:5B Extra‑territorial operation of ActAgencies…Organisations and small business operators(1A)This Act, a registered APP code and the registered CR code extend to an act done, or practice engaged in, outside Australia and the external Territories by an organisation, or small business operator, that has an Australian link.Note:The act or practice overseas will not breach an Australian Privacy Principle or a registered APP code if the act or practice is required by an applicable foreign law (see sections 6A and 6B).Australian link(2)An organisation or small business operator has an Australian link if the organisation or operator is:(a)an Australian citizen; or(b)a person whose continued presence in Australia is not subject to a limitation as to time imposed by law; or(c)a partnership formed in Australia or an external Territory; or(d)a trust created in Australia or an external Territory; or(e)a body corporate incorporated in Australia or an external Territory; or(f)an unincorporated association that has its central management and control in Australia or an external Territory.(3)An organisation or small business operator also has an Australian link if all of the following apply:(a)the organisation or operator is not described in subsection (2);(b)the organisation or operator carries on business in Australia or an external Territory;(c)the personal information was collected or held by the organisation or operator in Australia or an external Territory, either before or at the time of the act or practice.…

Decision

Reasons for decision

The Commissioner contended that:(1)the failure of Facebook Inc and Facebook Ireland to take the steps identified above, was an act or practice that was a serious interference with the privacy of the affected individuals contravening s 13G(a); and(2)the repeated and consistent failure, over the relevant period, of Facebook Inc and Facebook Ireland to take the steps identified above to prevent the unauthorised disclosure of the personal information of the affected individuals contravened s 13G(b).C.4.5 Conclusion with respect to r 10.43(4)(c) A sufficient prima facie case on the basis articulated by the Commissioner has been shown, in the sense earlier described, to warrant service outside of Australia. At the risk of repetition that is not to say anything about the strength of the case. Rather, the material demonstrates a genuine argument about contravention, sufficient to justify causing the respondents to be subject to the litigation in Australia where the merit of that argument can be judicially determined. It is to be recognised that there are defences which might be available to the respondents. The fact that defences might be available does not, in the circumstances of this case, undermine the existence of the prima facie case. For example, APP 6.1(a), read with the definition of “consent” in s 6(1) of the Privacy Act, contains a defence for an APP entity to use or disclose personal information for a secondary purpose where the individual has expressly or impliedly consented to the use or disclosure. It may be that there will be an argument about whether this defence is available at least in respect of certain individuals. It is not possible, however, on the material on this application to conclude that friends of an installer, being friends who did not install the app, relevantly provided consent. The requirements of r 10.43(4)(c) are satisfied.C.5 Residual discretion The Court retains a residual discretion to refuse relief even where the requirements for service outside Australia are satisfied: Humane Society International Inc v Kyodo Senpaku Kaisha Ltd (2006) 154 FCR 425 at [3] (Black CJ and Finkelstein J). The Commissioner pointed to the following discretionary matters as favouring the exercise of the discretion to order service outside Australia: (1)First, correspondence and a media report indicate that the respondents are aware of the proceedings and of the fact that the Commissioner proposed to make this interlocutory application:·King & Wood Mallesons (KWM) had represented the respondents during the Commissioner’s inquiries, culminating in the commencement of the proceeding. On 6 March 2020, the Australian Government Solicitor (AGS) emailed KWM to request confirmation of whether KWM had instructions to accept service of the originating process. On 6 March 2020, KWM emailed AGS advising that KWM acted for the respondents but were not instructed to accept service on their behalf; and stating that, in order to serve the respondents, the Commissioner would need to comply with relevant requirements for service at their respective domiciles in the United States and Ireland. The letter also made clear that KWM had instructions to discuss the substantive issues raised in the proceedings.·On 9 March 2020, AGS emailed KWM attaching sealed copies of the originating application, statement of claim and concise statement, asking KWM to draw these to their clients’ attention, and inviting the respondents to reconsider their position in respect of service so as to avoid the delay and expense that would be caused by an application by the Commissioner to serve the above documents outside the jurisdiction. On 12 March 2020, KWM emailed AGS advising that KWM did not have instructions in relation to the matters raised in the documents that AGS provided on 9 March 2020.·On 10 March 2020, a media report attributed comments, which I infer were related to the proceeding, to a Facebook spokesperson.(2)Contemporary developments in communications and transport make the degree of “inconvenience and annoyance” to which a foreign defendant would be put, if brought into the courts of this jurisdiction, “of a qualitatively different order to that which” prevailed at the time of earlier decisions considering these issues: Agar v Hyde (2000) 201 CLR 552 at 571 (Gaudron, McHugh, Gummow and Hayne JJ).

Ratio Decidendi

Legal Principle Established

Section 5B of the Privacy Act includes:5B Extra‑territorial operation of ActAgencies…Organisations and small business operators(1A)This Act, a registered APP code and the registered CR code extend to an act done, or practice engaged in, outside Australia and the external Territories by an organisation, or small business operator, that has an Australian link.Note:The act or practice overseas will not breach an Australian Privacy Principle or a registered APP code if the act or practice is required by an applicable foreign law (see sections 6A and 6B).Australian link(2)An organisation or small business operator has an Australian link if the organisation or operator is:(a)an Australian citizen; or(b)a person whose continued presence in Australia is not subject to a limitation as to time imposed by law; or(c)a partnership formed in Australia or an external Territory; or(d)a trust created in Australia or an external Territory; or(e)a body corporate incorporated in Australia or an external Territory; or(f)an unincorporated association that has its central management and control in Australia or an external Territory.(3)An organisation or small business operator also has an Australian link if all of the following apply:(a)the organisation or operator is not described in subsection (2);(b)the organisation or operator carries on business in Australia or an external Territory;(c)the personal information was collected or held by the organisation or operator in Australia or an external Territory, either before or at the time of the act or practice.… The Commissioner did not contend that s 5B(2) applied. She contended that each paragraph of s 5B(3) was satisfied. Relevant to s 5B(3)(c), s 6(1) defines “collects” and “holds” in the following way:collects: an entity collects personal information only if the entity collects the personal information for inclusion in a record or generally available publication.holds: an entity holds personal information if the entity has possession or control of a record that contains the personal information. In my view, there is a prima facie case, in the limited sense earlier described, that each of the paragraphs of s 5B(3) is satisfied. As to s 5B(3)(b), the evidence, some of which is the subject of the proposed interim suppression or non-publication order, establishes a prima facie case that the respondents carried on business in Australia in the relevant sense – cf: Tiger Yacht Management Ltd v Morris (2019) 268 FCR 548 at [50]-[54] (McKerracher, Derrington and Colvin JJ); Anchorage Capital Partners Pty Ltd v ACPA Pty Ltd (2018) 259 FCR 514 at [99] (Nicholas, Yates and Beach JJ); Australian Competition and Consumer Commission v Valve Corporation (No 3) (2016) 337 ALR 647 at [199]-[204] (Edelman J). The prima facie case arises from material which is capable of supporting the conclusion that:(1)Australian users contracted with Facebook Ireland, which described itself as the “data controller for Australian Facebook users”;(2)Facebook Ireland provided the Facebook service to Australian users as agent for Facebook Inc.