Facebook’s fight with Australian privacy regulators over the Cambridge Analytica scandal has hit the High Court

The battle between Facebook and the Office of the Australian Information Commissioner (OAIC) had a hearing in the High Court this week over the infamous Cambridge Analytica scandal in which the personal data of 300,000 Australians was harvested without their consent.

Facebook has been fighting a court battle for three years following revelations that between 2014 and 2015, the ‘This is Your Digital Life’ app on its platform scraped profile data from everyone who used it and that of all of their friends, thanks to a feature in Facebook’s API.

More than 80 million people worldwide had their data taken by the app that was then passed to infamous data analytics company Cambridge Analytica which claimed to have influenced more than 200 elections around the world.

Facebook tried unsuccessfully to defend itself in the Federal Court by arguing that Facebook Ireland – the holding company and international arm of its advertising business that was being sued – did not actually operate in Australia.

Now its lawyers are making their case in the High Court that its actions weren’t covered by the section of the Privacy Act that says an international organisation must have an “Australian link” which is determined by if it “carries on business in Australia”.

It’s those last five words that Facebook and the OAIC are tussling over before the actual Cambridge Analytica case can even begin.

Facebook, in its outline of the argument submitted to the High Court, claims that a business must “at a minimum” be shown to have “entered into commercial transactions” and that acts which merely “goes toward carrying on a business” – like data harvesting – don’t necessarily meet that test.

The OAIC lawyers claim this is nonsense, arguing that “although the data processing services were conducted in data centres overseas, the data processing included acts by Facebook Inc in Australia”.

Those data processing acts include installing cookies on people’s devices and administering Facebook’s ‘Graph API’ which “allowed apps to create a link or interface between the Facebook platform’s social graph and the app” in a way that was “integral to the commercial pursuits” of Facebook.

The Information Commissioner wants Facebook’s appeal dismissed on the grounds that the company was “carrying on its worldwide business in Australia” through both Facebook’s Irish holding company and directly via cookies and the Graph API.

Facebook’s lawyers said there was “no evidentiary basis” for the claim that cookies installed on Australian devices “produce a commercial benefit” for the US company.

It also pushes back against the OAIC’s argument that Facebook “held” personal information in Australia by installing them on local devices, saying evidence “shows that it is the user that has control over cookies installed on their device, being able to remove or block them at will”.

The High Court Case is ongoing.