Clifford Chance

The recent decision of the Full Federal Court of Australia in Facebook Inc v Australian Information Commissioner provides some clarity on the meaning of the phrase 'carrying on business' in Australia in the digital age. 

Last month the Full Federal Court upheld an earlier interlocutory ruling of the Federal Court granting the Australian Information Commissioner leave to serve initiating court documents on Facebook Inc (now Meta Platforms Inc) (Facebook US).

In doing so, the Full Federal Court confirmed that Facebook US prima facie 'carries on business' in Australia within the meaning of the Privacy Act 1988 (Cth) (Privacy Act), a decision which is expected to have important implications for offshore organisations.

Background

In March 2020, the Commissioner commenced proceedings against Facebook US (which provides the Facebook platform to users located in North America) and Facebook Ireland Limited (Facebook Ireland) (which provides the Facebook platform to users located anywhere else in the world, including Australia) alleging that the social media platform committed serious and/or repeated interferences with privacy in breach of the Privacy Act.

This unprecedent enforcement action was taken in response to the Facebook-Cambridge Analytica scandal, whereby the personal information of 86 million Facebook users  collected through Facebook's 'This is Your Digital Life' application was disclosed and used without consent for political profiling purposes in the lead up to the 2016 US Presidential Election. While only 53 Facebook users installed the application in Australia, the personal information of those users and over 300,000 of their friends was disclosed and used.

In April 2020, the Commissioner was granted leave to serve initiating court documents overseas on Facebook US and Facebook Ireland. In response, Facebook US (but not Facebook Ireland) filed an interlocutory application seeking to set aside service upon it, arguing, among other things, that it does not 'carry on business' in Australia and therefore does not fall within the ambit of the extra-territorial operation of the Privacy Act.

In September 2020, the Federal Court refused Facebook US' interlocutory application. That decision was appealed to the Full Federal Court.

Extra-territorial operation of the Privacy Act

Ordinarily, there is a presumption that Commonwealth legislation does not apply to persons outside of Australia._[1] However, this presumption is displaced where there is a clear legislative intention to the contrary.

Section 5B of the Privacy Act makes plain that the acts or practices of a foreign company will be subject to the Privacy Act if the foreign company has an 'Australian link'.  

An 'Australian link' will be established if the foreign company:

• 'carries on business' in Australia; and

• collects or holds personal information in Australia either before, or at the time of, the act or practice in question.

Full Federal Court decision

The Full Federal Court dismissed the appeal by Facebook US, finding that the primary judge was correct to conclude that there was a prima facie case that Facebook US was:

•  'carrying on business' in Australia by means of providing certain data processing services to Facebook Ireland (as detailed further below); and
• collecting personal information in Australia at the relevant time by means of cookies which it installed on Australian users’ devices.

Under a Data Transfer and Processing Agreement between Facebook US and Facebook Ireland, Facebook US was providing certain data processing services to Facebook Ireland. The Full Federal Court was satisfied that there was a prima case that some of these services took place in Australia, including:

• the installation and operation of cookies on Australian users’ devices; and
• the management of the Facebook login for Australian application developers.

Facebook US contended that the provision of these services to Facebook Ireland did not amount to 'carrying on business' in Australia  for two main reasons:

First, Facebook US argued that it lacked any physical presence in Australia and that, based on Australian case law, at least some of the following indicia had to be present in Australia in order for a foreign company to be 'carrying on business' in Australia:

• a fixed place of business;
• human instrumentalities;
• business assets;
• agents;
• contractual counter parties; and
• customers.

The Full Federal Court rejected this submission. In light of the objects of the Privacy Act and explanatory material which shed light on Parliament's intention in enacting the extra-territorial provisions of the Privacy Act (being the regulation of the flow of personal information), Justice Perram (with whom the other members of the Full Federal Court agreed) concluded that a foreign company can 'carry on business' in Australia without having any physical presence in Australia. His Honour observed that "the concept of carrying on business must… take its shape from the business being conducted… Whether a particular foreign-based business providing goods or services in this country carries on business here will depend on the nature of the business being conducted and the activity which takes place in this country.  There is no one size fits all answer to this question."   

Second, Facebook US argued that its activities in Australia lacked a commercial quality because Facebook US was not engaged in any commerce in Australia. In other words, only Facebook Ireland conducted business in Australia given that Facebook users and developers in Australia had contractual relations with Facebook Ireland and the revenue derived from them was earned by Facebook Ireland.

The Full Federal Court rejected this submission. The Court determined that the provision of data processing services to Facebook Ireland under the Data Transfer and Processing Agreement was sufficient to establish a prima facie case that Facebook US was 'carrying on business' in Australia. Relevantly for international businesses who have little direct contact with Australia, Justice Perram found that if a company conducts business in a foreign jurisdiction and it does acts within Australia as part of that business which fall into either the category of (i) activities undertaken as a commercial enterprise as a going concern with a view to a profit or (ii) carried on in a continuous and repetitive basis, then subject to any contrary implication arising from the statutory context, it will conduct business in Australia.

In separate reasons, Chief Justice Allsop observed that in determining whether a company is 'carrying on business' in Australia, the acts do not need to be intrinsically commercial so long as they involve acts within Australia that amount to, or are ancillary to, transactions that make up or support the business  His Honour further observed that the services provided by Facebook US to Facebook Ireland "may lack an intrinsic commercial character in and of themselves, but they are integral to the commercial pursuits" of Facebook US. 

The Full Federal Court agreed with the primary judge's finding that there was a prima facie case that Facebook US collected personal information in Australia through the installation of cookies on Australian users' devices. Justice Perram explained that "it is clear from the fact that the cookies are involved in the process of creating targeted advertising that an inference must be available that they were used for the collection of personal information".

The Full Federal Court noted that the primary judge erred in finding that Facebook US held personal information in Australia on the basis that Facebook US did not have possession or control of the ‘record’ containing personal information (being Australian users' devices which stored personal information by means of cookies), as required by the definition of 'holds' under the Privacy Act. Given that a prima facie case had been established that Facebook US collected personal information in Australia, this error was not material to the outcome.

The Full Federal Court's findings ultimately meant that the Commissioner was entitled to serve Facebook US with initiating court documents in the United States.

Key Takeaways

The Full Federal Court did not rule on whether Facebook US in fact 'carries on business' in Australia – this will need to be established at trial in order for Facebook US to be liable for the alleged breaches of the Privacy Act. Nonetheless, this decision provides some helpful guidance for offshore organisations in relation to the extra-territorial operation of the Privacy Act, particularly the meaning of the phrase 'carrying on business' in Australia.

It reinforces the importance of offshore organisations considering whether they are caught by the Privacy Act, even if they do not have a physical presence in Australia or engage in any commercial transactions directly with individuals located in Australia.

It also highlights the reluctance of the Courts to accept an application of the Privacy Act that is divorced from the realities of the increasingly digital commercial environment. It may be fairly said that, at least in the context of data privacy issues for 'information' businesses, the bar has been set low in terms of what will need to be shown to demonstrate that a business carries on business in Australia.

Following the Full Federal Court's decision,  the Commissioner expressed her intention to  move forward with the substantive matters in this proceeding.

We will continue to monitor developments with interest.

References

[1] Jumbunna Coal Mine NL v Victorian Coal Miners’ Association (1908) 6 CLR 309, 363.