Facebook Inc v Australian Information Commissioner

Link copied
Case Copied 77 min read

FEDERAL COURT OF AUSTRALIA

Facebook Inc v Australian Information Commissioner [2022] FCAFC 9  

Appeal from: Australian Information Commissioner v Facebook Inc (No 2) [2020] FCA 1307
File number: NSD 1076 of 2020
Judgment of: ALLSOP CJ, PERRAM, AND YATES JJ
Date of judgment: 7 February 2022
Catchwords: PRACTICE AND PROCEDURE – application for leave to appeal interlocutory decision dismissing application to set aside orders permitting service out of the jurisdiction – where originating application seeks relief under Privacy Act 1988 (Cth) (‘Act’) – where s 5B(3) of the Act requires ‘Australian link’ – whether Applicant carried on business in Australia – whether installation, operation and removal of cookies on Australian users’ devices and management of the Facebook login through Graph API occurred in Australia – whether Applicant collected or held personal information in Australia – whether prima facie case shown – appeal dismissed.
Legislation:

Constitution s 92

Privacy Act 1988 (Cth) ss 5B, 6, 6C, 15, Sch 1 (Australian Privacy Principles 6 and 11.1)

Federal Court Rules 2011 (Cth) rr 10.42(1), 10.43(1)(a)

National Parks and Wildlife Act 1974 (NSW) ss 124, 125

Cases cited:

Australian Competition and Consumer Commission v Prysmian Cavi E Sistemi Energia S.R.L (No 4) [2012] FCA 1323; 298 ALR 251

Cornelius v Phillips [1918] AC 199

D’arcy v Myriad Genetics Inc [2014] FCAFC 115; 224 FCR 479

Distillers Co (Biochemicals) Ltd v Thompson [1971] AC 458

Dow Jones v Gutnick [2002] HCA 56; 210 CLR 575

Hope v Bathurst City Council [1980] HCA 16; 144 CLR 1

Gebo Investments (Labuan) Ltd v Signatory Investments Pty Ltd [2005] NSWSC 544; 190 FLR 209

Jumbunna Coal Mine NL v Victorian Coal Miners’ Association (1908) 6 CLR 309

Lowe v Cant [1961] SASR 333

Luckins (Receiver and Manager of Australian Trailways Pty Ltd) v Highway Motel (Carnarvon) Pty Ltd [1975] HCA 50; 133 CLR 164

Mills v Charlesworth (1890) 25 QB 421

Project Blue Sky Inc v Australian Broadcasting Authority [1998] HCA 28; 194 CLR 355

Smith v Capewell [1979] HCA 48; 142 CLR 509

R v Baxter [1972] 1 QB 1

The Queen v Rogers (No 2) (1877) 3 QBD 28

Valve Corporation v Australian Competition and Consumer Commission [2017] FCAFC 224 ; 258 FCR 190

Ward v The Queen [1980] HCA 11; 142 CLR 308

Pound, NR “Causation” (1957) 67 Yale Law Journal 1
Division: General Division
Registry: New South Wales
National Practice Area: Commercial and Corporations
Sub-area: Regulator and Consumer Protection
Number of paragraphs: 166
Date of hearing: 7 May 2021
Counsel for the Applicant: Mr N Hutley SC with Dr S Hartford Davis and Mr D Reynolds
Solicitor for the Applicant: King & Wood Mallesons
Counsel for the First Respondent: Dr RCA Higgins SC with Mr T Prince and Ms E Bathurst
Solicitor for the First Respondent: Australian Government Solicitor
Counsel for the Second Respondent: Ms C Amato
Solicitor for the Second Respondent: King & Wood Mallesons

ORDERS

NSD 1076 of 2020
BETWEEN:

FACEBOOK INC

Applicant

CaseChat AU logo

Keep reading for free

Create a free CaseChat account to read Facebook Inc v Australian Information Commissioner and more:

  • Read every judgment in full
  • Ask AI and get answers linked to paragraphs
  • See how each paragraph was cited in later cases
  • Download judgments as PDF or Word
Continue with Google

One click creates your free account or signs you in.

By continuing you agree to the Terms and Privacy Policy.

Details
Case
[2022] FCAFC 9
Decision Date

CaseChat Overview and Summary

In the case of Facebook Inc v Australian Information Commissioner, the respondents sought to hold Facebook Inc accountable for the misuse of personal information obtained through an application called "This Is Your Digital Life," which was developed by Dr Aleksandr Kogan and Global Science Research Ltd. The Australian Information Commissioner alleged that Facebook Inc breached Australian Privacy Principles 6 and 11.1(b) of the Privacy Act 1988 (Cth). The primary issue before the court was whether Facebook Inc had an "Australian link" as required by section 5B(3) of the Privacy Act, meaning that Facebook Inc must both carry on business in Australia and have collected or held personal information in Australia. The court had to determine if the installation, operation, and removal of cookies on Australian users’ devices, and the management of the Facebook login through Graph API occurred in Australia, and if Facebook Inc collected or held personal information in Australia.

The court concluded that it could be inferred that Facebook Inc was carrying on business in Australia and had collected personal information in Australia. It was held that there was a prima facie case that an Australian link was present, and thus, the Privacy Act applied to the extra-territorial conduct by Facebook Inc. Consequently, the primary judge was correct to refuse Facebook Inc’s application to set aside service upon it. The appeal was dismissed, and the court granted Facebook Inc leave to appeal on the terms of the draft notice of appeal, directing that the notice of appeal be filed within 7 days, and that the respondent file her Notice of Contention within 7 days of the filing of the notice of appeal. Additionally, the appellant was ordered to pay the respondent’s costs of the appeal, including the costs of the application for leave to appeal.

In summary, the court found that Facebook Inc had an Australian link as required by section 5B(3) of the Privacy Act, and therefore, the Privacy Act applied to Facebook Inc's conduct. The appeal was dismissed, and the appellant was ordered to pay the respondent’s costs.

Orders

Orders of the court

1. The applicant be granted leave to appeal on the terms of the draft notice of appeal.

2. The notice of appeal be filed within 7 days hereof.

3. The first respondent file her Notice of Contention within 7 days of the filing of the notice of appeal.

4. The appeal be dismissed.

5. The appellant pay the first respondent’s cost of the appeal (including the costs of the application for leave to appeal).

Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

Background

Background to the litigation

Before turning to the issues which arise it is convenient to describe the events which have given rise to the litigation and to do so without distinguishing between Facebook Inc and Facebook Ireland. I will use the expression ‘Facebook’ as a placeholder to indicate that either or both of them did the act or thing described. Background The Commissioner’s suit concerns an application known as This Is Your Digital Life. The application was created by Dr Aleksandr Kogan, a researcher employed by, or affiliated with, Cambridge University and from May 2014 was operated by a company of which he was a shareholder and director, Global Science Research Ltd (‘GSR’). I will refer to Dr Kogan and GSR as ‘the Developers’. Dr Kogan described This Is Your Digital Life in a document he provided to Facebook. In that document, he described This is Your Digital Life as: a research app used by psychologists. The requested permissions provide the research team with a rich set of social behaviour that Users engage in. This app is used in studies where we link psychological traits and behaviour (typically measured using questionnaires) with digital behaviour data in the form of Facebook information. We aim to use this data to better understand how big data can be used to gain new insights into people’s well-being, personality traits, and other psychological constructs. As is common with many applications, This Is Your Digital Life invited persons wishing to use it to log in using their Facebook account. Perhaps unlike many applications, however, it did not offer any alternate means of doing so (for example, by creating a username and password). Users who used their Facebook logins to access This Is Your Digital Life were asked for permission by the application to access the personal information held by Facebook about them and also for access to the personal information of their Facebook friends. These permissions were subject to each user’s own privacy settings. Having obtained the user’s permission, the Developers then requested that Facebook provide them with access to that user’s personal information and that of the user’s friends. Facebook provided this information, however, under the terms which governed the Developers’ use of the Facebook login. Under these terms, the Developers were not permitted to use the information other than for the purposes of the application. The Developers breached this requirement by permitting the personal information to be used for the purpose of political campaigns. In Australia, approximately 53 Facebook users installed This Is Your Digital Life but the Developers obtained not only their personal information but that of approximately 311,074 of their Facebook friends. The Commissioner’s suit alleges, in a nutshell, that these events involved Facebook in contraventions of the Privacy Act 1998 (Cth) (‘the Privacy Act’). Specifically, the Commissioner says that Facebook Ireland and Facebook Inc have each breached Australian Privacy Principles (‘APPs’) 6 and 11.1(b). What are these?The Privacy Act and its operation to entities outside of Australia

Evidence

Evidence Before The Court

Full text does not contain this section.

Decision

Reasons for decision

In light of these matters, I do not think that the primary judge was correct to conclude that an inference was open that the personal information was held by Facebook Inc. However, because it may be inferred that Facebook Inc did collect the personal information in Australia for inclusion in a record this is not material to the outcome.CONCLUSIONS ON THE APPEAL The primary judge was correct to conclude that an inference was available that Facebook Inc was carrying on business in Australia and that it collected in Australia the personal information which is the subject of the Commissioner’s case under APP 11. There was therefore a prima facie case that an Australian link was present and therefore that the Privacy Act applied to extra-territorial conduct by Facebook Inc. In that circumstance, his Honour was correct to refuse Facebook Inc’s application to set aside service upon it. I have mentioned ground 2 of the Commissioner’s draft Notice of Contention above at [142]. By ground 1 of her draft Notice of Contention, the Commissioner sought to uphold the primary judge’s conclusions on the basis of an argument his Honour rejected. This was that Facebook Ireland and Facebook Inc were in truth conducting a single business which was the Facebook platform. Given that the appeal is to be dismissed it is not necessary to deal with this contention. I would propose the following orders:(1)Grant the Applicant leave to appeal on the terms of the draft notice of appeal.(2)Direct that the notice of appeal be filed within 7 days hereof.(3)Direct that the Respondent file her Notice of Contention within 7 days of the filing of the notice of appeal.(4)Appeal dismissed.(5)The Appellant pay the Respondent’s cost of the appeal (including the costs of the application for leave to appeal). I agree with the reasons for judgment prepared by Perram J and with the orders proposed by his Honour.

Ratio Decidendi

Legal Principle Established

In Australia, approximately 53 Facebook users installed This Is Your Digital Life but the Developers obtained not only their personal information but that of approximately 311,074 of their Facebook friends. The Commissioner’s suit alleges, in a nutshell, that these events involved Facebook in contraventions of the Privacy Act 1998 (Cth) (‘the Privacy Act’). Specifically, the Commissioner says that Facebook Ireland and Facebook Inc have each breached Australian Privacy Principles (‘APPs’) 6 and 11.1(b). What are these?The Privacy Act and its operation to entities outside of Australia APPs 6 and 11.1(b) are located in Sch 1 to the Privacy Act. By s 15 of that Act, an organisation (which by s 6C includes a body corporate) must not do any act, or engage in a practice that breaches an APP. APP 6 prevents an organisation which has collected information for a particular purpose to use it for another, except in limited circumstances. APP 11.1(b) requires an organisation which holds personal information to take reasonable steps to protect that information from unauthorised disclosure. It is presumed that a Commonwealth statute does not apply to persons outside of Australia: Jumbunna Coal Mine NL v Victorian Coal Miners’ Association (1908) 6 CLR 309 at 363 per O’Connor J. That presumption will be displaced, however, where the statute exhibits an intention to displace it. The Privacy Act is explicit in applying to persons outside of Australia although only in some circumstances. So much flows from s 5B, which is entitled ‘Extra-territorial operation of Act’. Section 5B(1A) applies the Privacy Act to acts done or practices engaged in ‘outside Australia’ if they are done or engaged in by an organisation that ‘has an Australian link’. Where a body corporate such as Facebook Inc or Facebook Ireland is concerned, an Australian link will be present if two requirements are satisfied: first, the body corporate must carry on business in Australia (s 5B(3)(b)); and secondly, it must have collected or held personal information in Australia (s 5B(3)(c)). Importantly, it follows from the text and structure of s 5B that the ‘personal information’ so collected or held must be the information which forms the subject matter of the acts or practices said to breach an APP (I explain why this is so in more detail below). In other words, an Australian link will only be present where an organisation has collected or held personal information in Australia and it is that information which is alleged to have been misused or mishandled in contravention of the Act. If, for example, Facebook Inc collected personal information from users in Australia and then separately collected and misused personal information from users in the United States, such conduct would be beyond the scope of the Privacy Act. As a matter of drafting, this has been achieved in a way which is obscure. Section 5B(3) provides:(3) An organisation or small business operator also has an Australian link if all of the following apply:(a) the organisation or operator is not described in subsection (2);(b) the organisation or operator carries on business in Australia or an external Territory;(c) the personal information was collected or held by the organisation or operator in Australia or an external Territory, either before or at the time of the act or practice.