Clifford Chance

The High Court of Australia has revoked Facebook's leave to appeal, allowing the privacy regulator's substantive action regarding the Cambridge Analytica scandal to proceed in the Federal Court of Australia.

Background

In 2020, the Australian Information Commissioner, commenced proceedings against Facebook Inc (now Meta Platforms Inc) (Facebook US) and Facebook Ireland Limited (Facebook Ireland) in response to the Cambridge Analytica scandal. The Commissioner alleges that serious and/or repeated breaches of the Privacy Act occurred between 2014 and 2015 as a result of the disclosure of the personal information of over 300,000 Australian Facebook users.

As part of the proceeding, the Commissioner sought to serve initiating court documents on Facebook US and Facebook Ireland overseas. In order to do so, under the Federal Court Rules 2011 applicable at the time, the Commissioner was required to apply to the Federal Court for leave for overseas service. In turn, this required the Commissioner to show that that there was a prima facie case that Facebook 'carried on business' in Australia within the meaning of the Privacy Act 1988.

Facebook US sought to set aside the service of the initiating court documents on the basis that it did not 'carry on business' in Australia in the relevant period. While it was unsuccessful in its interlocutory application to the Federal Court and subsequent appeal to the Full Federal Court, it was granted special leave to appeal to the High Court of Australia in October 2022, as covered in our previous post on this case, Still carrying on: High Court of Australia to decide whether Facebook 'carries on business' in Australia. One criterion for the grant of special leave is that a case is of public importance.

High Court Decision

Under amendments to the Federal Court Rules in January this year, plaintiffs are now able to serve initiating court documents overseas without obtaining the court's leave in certain circumstances, including where the proceeding 'relates to the construction, effect or enforcement of a law of the Commonwealth, a State or a Territory' (such as the Privacy Act). Following those amendments, the Commissioner applied to have the grant of special leave revoked.

In the course of the hearing of the revocation application, Facebook argued that under transitional provisions, the new Federal Court Rules only applied in relation to court documents first served on or after the commencement of the new rules on 13 January 2023, and therefore did not assist the Commissioner, who had first served the relevant documents prior to that date. The Commissioner disagreed but noted that even if Facebook were correct and her service were to be set aside, she intended to and could simply re-serve under the new rules. The High Court's line of questioning in the hearing suggests that the Commissioner's arguments carried some weight. Ultimately, the High Court found that due to the change of rules relating to the requirements of service, Facebook US' grounds of appeal were no longer of public importance, and revoked special leave.

Accordingly, the substantive proceeding against Facebook Ireland and Facebook US will return to the Federal Court.  

Next Steps

The Commissioner has signalled her intention to continue to pursue the substantive proceeding, which seeks unprecedented civil penalties against Facebook Ireland and Facebook US.

In this regard, the Commissioner remarked that the High Court's decision "is an important step in ensuring that global digital platforms can be held to account when handling the personal information of Australians".

This case proceeds against a backdrop of increasing public and government scrutiny on privacy law in Australia. Significant reforms to Australia's privacy law regime are expected to be enacted in the coming months, as indicated in a recent government report covered in our post, Prioritising Privacy: Highlights from Australia's Privacy Act Review Report.