The High Court of Australia Tuesday began hearing submissions that a Facebook app tied to the Cambridge Analytica scandal contravened national privacy laws. The oral submissions will determine whether Facebook is liable for consumer data breaches in contravention of the Privacy Act 1998 (Cth).
The Australian Information Commissioner commenced the action against Facebook in the Federal Court in 2020 for data breaches committed in 2014 and 2015, which has been appealed to the High Court. The issues to be addressed include whether a foreign corporation can “carry on business” in Australia if it has no other commercial activities or domestic business and whether the requirement of a “prima facie case” requires evidence that could support inferences sufficient to establish the cause of action.
Facebook submitted that the corporation itself conducted no commercial transactions in Australia, and that the installation and removal of “cookies” onto users’ devices does not constitute a business transaction. Facebook also submitted that the second respondent, Facebook Ireland, provided the Facebook service to Australian users. It further argued that it is “conjecture” that the cookies were used to gather the information pertaining to the case.
The commissioner submitted that “carrying on business in Australia” encompasses the privacy of individuals where “information flows across national borders,” and is not exclusive to “intrinsically commercial” acts. Further, the commissioner submitted that the Federal Court cases established that Facebook was “carrying on business directly in Australia, by installing and operating cookies and managing the Graph API for the purpose of providing the Facebook service in North America.”
If prosecuted, the penalty for repeated privacy breaches incurs a penalty of $2.2 million under the Privacy Act, a figure which was increased last year to a total of $50 million or three times the amount gained from the breaches. As the case commenced in 2020, Facebook may be penalized under the previous regime.
The case follows numerous court actions in the UK and the US for breaches of privacy relating to the Cambridge Analytica scandal which affected 50 million Facebook users. In 2014, 53 Australian Facebook users installed an application called “This is Your Digital Life” onto the platform. The application took the form of a personality quiz that compared users’ psychological traits and behavior with digital behavior to determine certain psychological constructs through big data. The app required users to sign into their Facebook accounts, which allowed app developers to obtain the personal information of over 300,000 of their Facebook friends.
Facebook and Cambridge Analytica, a British political consulting firm, developed the application. In 2018, Cambridge Analytica used the user data obtained for everything from psychological profiling to direct political advertising during the 2016 US election, which aimed to predict and influence voting preferences.
