Australia’s privacy watchdog has welcomed the Federal Court’s decision to dismiss an appeal from Meta, formerly Facebook, which stands accused of breaching Australian privacy law through the infamous Cambridge Analytica scandal.
The Office of the Australian Information Commissioner (OAIC) launched Federal Court action against the US-based Facebook in 2020, accusing the social media juggernaut of misusing the information of its Australian users and not taking “responsible steps” to keep that information safe.
Those accusations pertain to Australian user data siphoned through This Is Your Digital Life, a quiz app available through Facebook.
Court documents state only 53 Australian Facebookers used This Is Your Digital Life.
However, it obtained the personal data of some 311,074 Facebook users without their consent — and that information was later churned into analytics firm Cambridge Analytica for use in advanced political influence campaigns.
The OAIC successfully initiated legal action against Facebook in the Federal Court over those alleged privacy breaches.
The watchdog indicated it would seek financial penalties, which could add up to $1.7 million per breach.
“All entities operating in Australia must be transparent and accountable in the way they handle personal information, in accordance with their obligations under Australian privacy law,” Australian Information Commissioner and Privacy Commissioner Angelene Falk said at the time.
However, Facebook took issue with a key part of the OAIC’s legal argument — the reference to entities “operating in Australia”.
The company sought an interlocutory action, arguing it had not technically conducted business in Australia, as it serviced US users through Facebook Inc, and international users through Facebook Ireland.
Facebook’s efforts were denied by Justice Thomas Thawley in late 2020, who ultimately argued the company did operate and collect data in Australia.
Unsatisfied, the company again appealed.
Today’s ruling from the full bench of the Federal Court upheld Thawley’s decision, finding Facebook did indeed operate in Australia.
While questioning some of the conclusions drawn by Thawley, Justice Nye Perram said there was “no particular difficulty” understanding Facebook’s businesses as taking place in Australia.
Justice Perram found “no error” in Justice Thawley’s conclusion “that it could be inferred that Facebook Inc collected the personal information in Australia by means of cookies which it installed on the devices of Australian users”.
“The primary judge was correct to conclude that an inference was available that Facebook Inc was carrying on business in Australia and that it collected in Australia the personal information which is the subject of the Commissioner’s case under [the Privacy Act],” Perram added.
“There was therefore a prima facie case that an Australian link was present and therefore that the Privacy Act applied to extra-territorial conduct by Facebook Inc.”
Chief Justice James Allsop agreed, arguing “the relevant act done in Australia is the installation and operation of cookies on Australian users’ devices,” and dismissed suggestions Facebook’s business took place abroad.
In a Monday morning statement, the OAIC said Australian Information Commissioner and Privacy Commissioner Angelene Falk welcomed the decision.
The OAIC will “continue to move forward with the case and looks forward to the hearing of substantive matters,” the statement read.
A Meta spokesperson said the company is reviewing the decision but did not provide further comment.
This article originally appeared on Business Insider Australia.
