An Australian court has rejected an appeal by Facebook over the Cambridge Analytica data scandal, allowing court action to proceed.

In March 2021 the Australian Information Commissioner sued Facebook for disclosing the personal information of 311,127 Australian users to Cambridge Analytica via the This is Your Digital Life app, and claimed it had misled users as to how their data was being used. This was all wrapped up in the wider Cambridge Analytica scandal in which it was claimed data was being used to influence people’s voting.

In Australia It was asserted that Facebook violated Australian Privacy Principle 6 due to the fact many of the users did not download the app themselves, and therefore could not consent to it being used. The maximum penalty for breach of Australian privacy laws is $1.7 million for each violation.

“We consider the design of the Facebook platform meant that users were unable to exercise reasonable choice and control about how their personal information was disclosed. Facebook’s default settings facilitated the disclosure of personal information, including sensitive information, at the expense of privacy,” said Australian Information Commissioner and Privacy Commissioner Angelene Falk back in March. “We claim these actions left the personal data of around 311,127 Australian Facebook users exposed to be sold and used for purposes including political profiling, well outside users’ expectations.”

Facebook appealed on a seeming technicality, essentially claiming it did not ‘do business’ in Australia during the period in question. This argument was today thrown out, allowing legal action to proceed.

The details of the judgment were released in full, and the below two paragraphs are interesting in terms of a wider trend:

“…we are dealing with a business that is not manifested in physical or material matter or structures or goods, but as described by Perram J at [29]–[33] of his reasons, which can be described as the collection, storage, analysis, organisation, distribution, deployment and monetisation of information about people and their lives. How that monetisation takes place in relation to the activities carried on by Facebook Inc is neither clear nor the subject of this proceeding. One can be sure, however, that the acts done to collect, store, analyse, organise, distribute and deploy the information about people and their lives are integral to the methods of monetisation or extracting commercial value from the information. The business is not about the simple sale of goods whether tangible or intangible. It is about extracting value from information about people.

“The above is crucial in addressing the argument of Facebook Inc that there is a clear distinction useful for analysis here between physical acts and their consequences or effects. Facebook Inc’s business is not the sending of letters or telegrams, or the receipt of communications in California of messages sent by acts of users in other countries. To conceptualise what is occurring in such broken or particularised parts, especially by reference to more easily visualised in the mind physical activity, is to mischaracterise by oversimplification through the application of a false taxonomy of activity… This is particularly the case in relation to the placement of cookies on users’ devices in Australia. The act of a person need not be discrete and conceptually separated in reality from its consequences.”

What’s on display above is indicative of what’s happening in courts all around the world – the laborious but precise language of lawyers and legislation catching up to the lightspeed, ‘fail fast’ innovation of Silicon Valley, and the business practices it has invented over the last decade or so.

This case in Australia happens to be wrapped up in the Cambridge Analytica scandal, but the movement is larger, with numerous active cases against tech giants going on in the US, EU and the UK. On one level it looks like law makers clocking on to how internet monoliths like Facebook and Google make money and deciding it’s a bit dodgy, and on a wider level it seems to be about governments noticing just how massive and influential those firms have got in the process.