How Meta’s High Court challenge could change the Big Tech legal game

Yet as the dust settles this week, opinion remains divided as to whether a successful High Court appeal would set a precedent for US platforms campaigning either to keep their parent companies out of trouble or to have any claim heard by a court in California.

Those sceptical of Meta’s legal tactics argue that the High Court appeal is a stunt designed to wear down Australia’s notoriously underfunded Office of the Australian Information Commissioner, or OAIC, which brought the lawsuit against the platform.

Then there are privacy-law experts that believe a case so narrowly focused on the wording of Australia’s ageing 1988 Privacy Act is unlikely to haemorrhage into competition and consumer law – the main arenas in which Big Tech jurisdictional challenges are playing out in Australia.

There may be substance to both those interpretations, as Australia’s highest court prepares to hear the case. Nonetheless, the fact that Canberra-based judges are now set to answer a key question relating to the legal exposure of a tech giant remains significant.

When the ruling is handed down, companies and individuals planning to take action against a global platform in an Australian court will know whether they can aim high up the corporate ladder and target parent companies, or whether they need to temper their enthusiasm and be more selective.

As reported by MLex at the time, there were two clusters of arguments underpinning Meta’s move to appeal a Federal Court of Australia’s decision to push ahead with the lawsuit, despite the social-media platform’s insistence that Facebook Inc shouldn’t be included.

The first cluster dealt with the jurisdictional issue and the inclusion of Facebook Inc. — as it was called when the OAIC probe began — in the lawsuit. The second cluster dealt with whether a lawsuit should be allowed to get underway without evidence pointing to a clear violation.

The High Court’s “special leave” to appeal was granted for both arguments.

At the centre of the drama is Section 5B of the 1988 Privacy Act, which refers to the extra-territorial application of the legislation. For a foreign company to be caught under the provisions of the law, it needs to have an “Australian link” — a definition the High Court judges will need to examine.

The legislation lists six criteria for an organisation to meet this threshold: Australian citizenship; a person with permanent residency in Australia; a partnership formed in Australia; a trust created in Australia; a body corporate incorporated in Australia; an unincorporated association that has its central management and control in Australia.

But it’s the next limb of 5B, which was updated in 2014, that’s expected to be hotly contested in the High Court.

An organisation or a small-business operator has an “Australian link” if all three of the following criteria apply: The company isn’t caught by the previous six criteria; the company “carries on business in Australia”; the personal information was collected or held by the company in Australia “either before or at the time of” the impugned behaviour.

This leaves no wiggle-room for what was then Facebook Ireland, the company that owns the social-media platform’s Australian operations and can be linked directly to the collection of Australian users’ personal information and its sale to Cambridge Analytica.

While the High Court appeal will be based exclusively on legal arguments, the political backdrop of this challenge remains charged in Australia, with lawmakers already poised to review Section 5B in a way that would more readily capture platforms’ global parent companies.

Firstly, there’s no shortage of political will to act against Meta, as demonstrated by the bipartisan support for the world’s most draconian pieces of legislation targeting Facebook: The 2019 “abhorrent violent material” legislation and the 2018 encryption legislation.

The “abhorrent violent material” law could land Meta’s Australian employees in jail for up to three years if the company doesn’t “expeditiously” remove terrorist content from Australian feeds; while critics warn encryption laws could compromise the security — and, arguably, the very business model — of Facebook’s WhatsApp.

It’s in this political context that, in 2020, parliamentarians began their long-awaited review of the Privacy Act. As part of the revamp, in 2021 federal lawmakers also began to work on a bill specifically designed to protect online privacy and increase penalties for privacy-law violations.

The first draft of the online bill has yet to be presented to parliament. Yet documents published so far by the government as part of the review contain enough detail to suggest that Section 5B’s second limb — the three additional provisions that determine when a company may have a “link” to Australia — could be scrapped entirely.

In its explanatory notes, the Attorney General’s Department said that the proposed changes were required because, when a breach of the Privacy Act occurs, “it may be difficult to establish that these foreign organisations collect or hold personal information from a source in Australia”.

The reason for this difficulty, the notes say, is because large multinational companies may collect “personal information from Australian customers from an entity that is not incorporated in Australia and transfer it to other entities overseas for processing and storage”.

“Foreign organisations may collect personal information about Australians but do not collect Australians’ information directly from Australia and instead collect the information from a digital platform that does not have servers in Australia and may therefore not be considered ‘in Australia’,” the notes say.

Some observers argue that, with Australian lawmakers’ ready to strike down a key element of Section 5B, Meta’s High Court challenges will ultimately be counterproductive because it’s likely to focus public attention on the law’s extraterritorial shortcomings.

The argument is that Meta should cherish the moment if it wins this appeal because all digital-platform parent companies will be fair game once the law changes.

Additional reporting by Laurel Henning.

James Panichi covers regulatory affairs for LexisNexis’ MLex.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.