A ruling on the status of Cookies as a “record” by the Federal Court will be critical in allowing the company, now known as Meta, to be the subject of a lawsuit from the Office of the Australian Information Commissioner (OAIC). The OAIC is suing US-based Facebook Inc and Facebook Ireland over the alleged breaching of 311,000 Australian user's privacy.

About 53 Australian Facebook users are said to have disclosed personal information to a third-party app This Is Your Digital Life between March 2014 and May 2015. The app developers then gained access to more than 300,000 Facebook friends of those users, and shared their personal information with Cambrdige Analytica which used it for political profiling purposes.

This week Facebook lost an appeal after the Federal Court rejected its argument that it does not conduct business in Australia or store Australian information.

The judges described Facebook's explanation of how its tech works as "divorced from reality".

They noted that to prosecute its case the Commissioner was obliged to show that there was a prima facie case that:

(1)    there was an act of collection by Facebook Inc;

(2)    which took place in Australia; and

(3)    the personal information so collected was intended for inclusion in a record

Facebook argued that the effect of cookies was "no different to a person sending a letter from overseas to Australia, with the effect that upon its receipt, the reader did something which had an economic impact."

Justices James Allsop, Nye Perram, and David Yates concluded "The business is not about the simple sale of goods whether tangible or intangible.  It is about extracting value from information about people.”

They also rejected the notion that cookies "which makes Facebook work" were fixed at the location from which they were installed.

"An act may occur in more than one place, may be continuous, complex and multilateral, and not just physically instantaneous in one place," Justice Allsop said.

Justice Perram noted, “… the question of whether an overseas entity that installs cookies on a device in Australia is thereby carrying on business in Australia is likely to turn on the nature of the business it carries on and the nature of the cookie.  For example, a cookie which remembers a user’s login details so that they do not have to re-enter them each time a site is visited may stand in a somewhat different position to a cookie which tracks a user’s interest in chocolate biscuits so that the user’s newsfeed is peppered with advertisements for Tim Tams.

“… there is a prima facie case that in the conduct of its business of providing data processing services to Facebook Ireland, Facebook Inc installs cookies on devices in Australia and this is an activity which occurs in Australia.”

The initial judgment concluded that Facebook Inc had used cookies to store the personal information on the devices of Australian users and had therefore held the personal information in those devices. Facebook Inc submitted that it could not be in possession or control of those devices.

In rejecting the appeal, the primary judge noted, “The definition of ‘holds’ …  requires that Facebook Inc should be in possession or control of a ‘record’ which contains personal information.

“… Facebook Inc. (on behalf of Facebook Ireland) targeted advertisements at the users whose personal information was provided to This Is Your Digital Life. It was not submitted that such an inference could not be drawn. Hence, it may also be inferred that Facebook Inc used cookies in that endeavour and collected personal information from those users. It is that personal information which is the subject of the Commissioner’s case under APP 11. There is no question, therefore, that the information collected included the personal information the subject of the Commissioner’s allegations.”

Justice Perram also noted that “… trying to locate who is actually running the Facebook platform from the answers given by Facebook Inc and Facebook Ireland has much in common with Where’s Wally.”

Facebook Inc was ordered to pay the Australian Information Commissioner’s legal costs stemming from the appeal. Commissioner Angelene Falk said in a statement that she welcomed the decision and looked forward to the hearing of substantive matters.

https://www.judgments.fedcourt.gov.au/judgments/Judgments/fca/full/2022/2022fcafc0009