A personality quiz on Facebook, which led to the now-infamous Cambridge Analytica data breach, will take centre stage in the High Court of Australia as the social media company's owner, Meta, battles it out with the national privacy commissioner.
As the High Court will hear, in 2014, Cambridge Analytica worked with a Facebook application developer to create an application that was at the root of a massive data breach, estimated to have collected data from more than 90 million Facebook users worldwide without their knowledge or consent.
The application collected this data not just by pulling information from the public profiles of those who used Facebook to log into personality quizzes, but also by collecting details from anyone who was friends with them on the social media site.
In Australia, 53 people logged in to the quiz through Facebook, which is believed to have exposed up to 300,000 Facebook friends to a possible data breach.
It later emerged the material obtained by Cambridge Analytica was used for psychological profiling to target political messages in the 2016 Trump election campaign in the United States.
When the issue came to light in 2018, Facebook moved quickly to sever ties with Cambridge Analytica and to warn users who were possibly affected.
The company has now also moved to restrict data access to third parties more broadly.
Facebook has already faced court action and substantial fines of billions of dollars in the UK and US.
But since 2020, Facebook has been fighting a battle in the Australian courts to avoid prosecution for breaching privacy laws in this country.
The Australian Information Commissioner will inform the High Court that between March 12, 2014, and May 1, 2015, Facebook seriously and repeatedly interfered with the privacy of more than 300,000 Australian Facebook users.
In submissions to the court, the commissioner says that personal information shared with the third-party app was a clear breach of Australian privacy laws.
"Facebook entities did not adequately inform the affected Australian individuals of the manner in which their personal information would be disclosed, or that it could be disclosed to an app installed by a friend," the submissions to the High Court read.
"The Facebook entities failed to take reasonable steps to protect those individuals' personal information from unauthorised disclosure."
Facebook facing $2.2m penalty
Australia's privacy laws allow for prosecution overseas if a link to Australia is proven.
The battle between Facebook and Australia's Information Commissioner has so far been waged in the Federal Court, where two rulings have been made in the commissioner's favour.
But Facebook is using the High Court to challenge the very foundation of the case itself.
To pursue Facebook under Australia's privacy laws, the commissioner must show that the company, while overseas, carried out business in Australia.
Facebook says at the time it did not have a commercial presence in Australia, with no personnel, revenues or business premises.
"It is clear that the necessary quality of commerciality is totally missing on the unchallenged facts before this court," Facebook said in its submissions.
And while the Federal Court previously found things like the installation of cookies were a demonstration of commercial activity, Facebook will tell the High Court it is conjecture that its cookies were even involved in gathering the information in the current case.
The penalties for repeated privacy breaches under Australian law increased last year from $2.2 million to either $50 million or three times the value of any monetary gain.
Because the Facebook prosecution began in 2020, if any penalty is imposed, it would be under the earlier regime.
