Clifford Chance

The High Court will hear Facebook's challenge to the Full Federal Court of Australia's finding that it 'carries on business' in Australia. The High Court's decision, once handed down, is expected to provide clarity as to the obligations of offshore organisations under Australian privacy laws.

Earlier this year, the Full Federal Court of Australia upheld an interlocutory ruling of the Federal Court of Australia that Facebook Inc (now Meta Platforms Inc) (Facebook US) prima facie 'carries on business' in Australia within the meaning of the Privacy Act 1988 (Privacy Act).

The High Court has since granted Facebook US special leave to appeal the Full Federal Court's decision.

Background

 As covered in our previous article on the case, Australian Privacy Commissioner's case against Facebook to carry on: Facebook found to be 'carrying on business' in Australia, in the wake of the Facebook-Cambridge Analytica scandal, in 2020 the Australian Information Commissioner (the Commissioner) commenced action against Facebook US and Facebook Ireland Limited (Facebook Ireland), alleging that the social media platform had committed various breaches of the Privacy Act.

As part of the broader proceedings, Facebook US filed an interlocutory application seeking to set aside service of court documents overseas, arguing that it did not 'carry on business' in Australia and therefore fell outside the extra-territorial operation of the Privacy Act.

Under section 5B of the Privacy Act, an overseas organisation will fall within the operation of the Act if it:

• carries on business in Australia; and
• collects or holds personal information from individuals in Australia.

The Full Federal Court decided that there was a prima facie case that Facebook US met both criteria, as it was:

• 'carrying on business' in Australia by providing certain data processing services to Facebook Ireland
• collecting personal information in Australia at the relevant time by means of cookies which it installed on Australian users' devices.

Central to the Full Federal Court's decision was its finding that if a company conducts business in a foreign jurisdiction and it does acts within Australia as part of that business which fall into one of the two categories of:

• activities undertaken as a commercial enterprise as a going concern with a view to a profit; or
• activities carried on in a continuous and repetitive basis, then, subject to any contrary implication arising from the statutory context, it will conduct business in Australia.

Special Leave Application

In its special leave application to the High Court, Facebook US argued that the Full Federal Court had erroneously set an 'overbroad' and 'wholly new' test for determining whether a company is carrying on business in Australia. Alluding to the 'important question of law' at the heart of the matter, Facebook US argued that the Full Federal Court's test would open many overseas organisations with no real 'Australian link' to claims in Australia. On the other hand, the Commissioner argued that the Full Federal Court had not stated a new test, but had merely applied a test set in the 2017 decision of the Full Federal Court in ACCC v Valve (Valve), the correctness of which was not in dispute. The Commissioner contended that in line with the test established in Valve, 'so long as there are activities carried on by an entity within the jurisdiction, they are at least ancillary to transactions that make up or support the business. That entity will be carrying on business in Australia…'

Facebook US also argued that, contrary to the Full Federal Court's findings, it had not collected personal information within the meaning of section 5B of the Privacy Act merely through its use of 'cookies'. It followed that the Full Federal Court had drawn an incorrect inference that the use of cookies necessarily entailed the collection of information, with no expert evidence being adduced to confirm this point.

The High Court granted Facebook US' application for special leave.

Next Steps

In light of the High Court's decision to grant special leave to hear Facebook US' appeal, the meaning of the phrase 'carrying on business' in Australia under the Privacy Act is once again uncertain.

For now, offshore organisations should be conscious of the low bar set by the Full Federal Court, under which, as Facebook US argued, an organisation may be held to 'carry on business' in Australia even if it 'has no commercial presence in Australia; had no contract with Australian users or other contract counterparties; had no personnel in Australia; it earned no revenues from Australia; had no premises or other property' in Australia.

If the Full Federal Court's decision is upheld by the High Court, offshore 'information' businesses should be wary that Australian privacy laws may impose obligations not only on active local subsidiaries, but also on offshore entities with a less direct Australian nexus.

We await the High Court's hearing of the matter with interest.