The absence of physical indicia in Australia
69 Facebook Inc submitted that it had no physical assets, customers or revenues in Australia. The data processing services were, on the evidence, provided from data centres which were located in the United States and Sweden. I take it to be implicit in that submission that the data centres consisted of physical premises containing servers and some employees. Facebook Inc submitted that before it could be held that a foreign corporation was carrying on business in Australia it had to be shown that at least some of the following were present: a fixed place of business, human instrumentalities (perhaps, humans), business assets, agents, contractual counter parties and customers. It submitted that there was not a single case which had held a foreign corporation to be carrying on business in a particular place where at least one of those elements was not present.
70 I do not accept this submission. Whilst it is common to speak of the general approach to the question of whether an entity is carrying on business in a jurisdiction, usually the question arises in a particular statutory context. In this case, the question is whether Facebook Inc 'carries on business in Australia' within the meaning of s 5B(3)(c) of the Privacy Act. The expression 'carries on business in Australia' is not a defined term in the Act. However, its meaning is informed by the statute in which it appears. Two matters are relevant. First, the objects of the Act include by s 2A(f) the facilitation of 'the free flow of information across national borders while ensuring that the privacy of individuals is respected'. The statute therefore has in its contemplation the regulation of the flow of information insofar as it concerns privacy. Secondly, the terms of s 5B(3)(c) suggest that the focus of the Act is on the enforcement of the APPs in relation to the collection or holding of personal information. It is true that s 5B(3)(b) imposes the additional requirement that the organisation carry on business in Australia but that does not change the fact that this statute has as its focus a non-material concept: information.
71 I am unable in that circumstance to discern the presence of a negative implication in the Act which altogether denies the possibility that a business might be conducted in Australia without any of the indicia to which Facebook Inc points. The absence of such a negative implication is confirmed by the Explanatory Memorandum which accompanied the introduction of s 5B(3)(b):
Item 6 Subsection 5B(3)
Item 6 will amend subsection 5B(3) by rephrasing the opening of the subsection and inserting a reference to the new term 'Australian link'. This will clarify that the subsection lists additional connections with Australia which would be a sufficient link for the Privacy Act to operate extra-territorially in relation to organisations and small business operators under subsection 5B(1A).
The collection of personal information 'in Australia' under paragraph 5B(3)(c) includes the collection of personal information from an individual who is physically within the borders of Australia or an external territory, by an overseas entity.
For example, a collection is taken to have occurred 'in Australia' where an individual is physically located in Australia or an external Territory, and information is collected from that individual via a website, and the website is hosted outside of Australia, and owned by a foreign company that is based outside of Australia and that is not incorporated in Australia. It is intended that, for the operation of paragraphs 5B(3)(b) and (c) of the Privacy Act, entities such as those described above who have an online presence (but no physical presence in Australia), and collect personal information from people who are physically in Australia, carry on a 'business in Australia or an external Territory'.
(Emphasis added)
72 The emphasised part of the quote goes somewhat further than the language of s 5B(3)(b) probably permits. In particular, it appears to assume that the collection or holding of personal information under s 5B(3)(b) is sufficient to constitute the carrying on of a business under s 5B(3)(b). I do not think that the language of s 5B(3) can bear such an interpretation. As Facebook Inc correctly submitted, the requirements of ss 5B(3)(b) and (c) are cumulative. Read in the precise way that the Explanatory Memorandum suggests, s 5B(3)(b) appears to have no work to do which is not normally regarded as a likely interpretation: Project Blue Sky Inc v Australian Broadcasting Authority [1998] HCA 28; 194 CLR 355 at [71] (per McHugh, Gummow, Kirby and Hayne JJ). However, the statement is still useful because it is consistent with the conclusion which flows from the objects of the Act and the terms of s 5B(3) itself: that there can be no negative implication that an organisation cannot carry on business in Australia unless it has a physical presence of some kind in Australia.
73 Of course, to say that there is no such negative implication does not take the matter very far. In particular, it does not demonstrate that Facebook Inc is carrying on business in Australia merely because it does not have any of the suggested local attributes.
74 Is it possible to conduct business in Australia without having any physical presence within the jurisdiction? The primary judge concluded that 'the means by which entities carry on business are constantly evolving'. He then observed that many of the cases in which the concept of carrying on business was discussed were 'decided long before the technological advances which underpin many forms of commerce'. I agree with his Honour. The concept of carrying on business must, of necessity, take its shape from the business being conducted. Whilst the indicia to which Facebook Inc points no doubt have their place, I do think that some care has to be exercised about those statements to ensure that obvious propositions about the qualities of businesses at one time are not misapplied to radically different businesses at another. Facebook Inc submitted that the primary judge had, by making these observations, stated that the test needed to be changed. It is quite clear, with respect, that his Honour said no such thing.
75 Nor do I accept the submission that the primary judge's approach would entail that any modern business conducted on the internet with a website accessible in Australia would be carrying on business in Australia. What this case decides is only that an inference may be drawn that a firm which installs and removes cookies in Australia (and which also manages for Australian developers a credential system which is widely used in Australia) is carrying on its worldwide business of data processing in this country. Whether a particular foreign-based business providing goods or services in this country carries on business here will depend on the nature of the business being conducted and the activity which takes place in this country. There is no one size fits all answer to this question. Correspondingly, the menace of opened floodgates from which Facebook Inc was commendably keen to protect the Australian legal system, is in my view very much overstated.
76 Nor do I accept the more radical form of this submission which Facebook Inc also pursued. It submitted that what had happened in this case was the transmission of digital signals from the data centres to user devices and that the transmission had brought about a change in the digital state of the devices. As such, all that happened was that action taken outside of the jurisdiction had resulted in an effect within the jurisdiction. Mr Hutley made the submission that once this was appreciated it could be seen that the current situation was no different to a person sending a letter from overseas to Australia, with the effect that upon its receipt, the reader did something which had an economic impact.
77 The problems with this submission are first that it proves far too much, and secondly that it is, with respect, divorced from reality. It proves too much because it has the consequence that no computer-based activity in one jurisdiction can ever amount to more than an effect in computers located in another. The submission has the result that no internet business based in one jurisdiction can ever carry on business in another. Any such business will, at best, be sending electronic signals to computers within Australia which will cause effects in those computers. But, according to the submission, mere effects cannot constitute the carrying on of a business. This extreme conclusion suggests the presence within the submission of error.
78 The error is the failure to account for the reality of what the signals and effects constitute. For example, there is an obvious distinction between an overseas website which provides data to an Australian computer when requested to do so, and an application that installs executable code on that computer and then causes it be executed. Facebook Inc's submission lumps these two quite different situations together. Whilst Facebook Inc's description of what is occurring is not wrong, it is pitched at such a high level of generality that it is, in my respectful opinion, useless as a tool of analysis. One might also say that Facebook Inc had done no more than turn on and off vast numbers of tiny switches - a true statement since all computers operate solely by switching on and off binary digits - but the statement, whilst true, is not helpful for grasping anything about the activities which Facebook Inc is actually engaged in. By parity of reasoning, one learns little about art history by observing that Rembrandt's The Night Watch consists of some pigments on canvas in a wooden frame.
79 It is not necessary in that circumstance to assess Facebook Inc's submission that mere effects within Australia cannot constitute carrying on a business. This is not a case of mere effects. For the same reason, the correctness of Mr Hutley's analogy with the postal system does not fall for consideration.
80 Facebook Inc also placed particular reliance on Gebo and Valve Corporation v Australian Competition and Consumer Commission [2017] FCAFC 224; 258 FCR 190 ('Valve'). In Gebo Barrett J said at [33]:
Advances in technology making it possible for material uploaded on to the internet in some place unknown to be accessed with ease by anyone in Australia with internet facilities who wishes (or chances) to access it cannot be seen as having carried with them any alteration of principles as to the place of carrying on business developed at times when such communication was unknown. It has never been suggested that someone who by, say, letters posted in another country and addressed to recipients in Australia, seeks to interest those persons in business transactions to be entered into in the other country and in fact succeeds in concluding such transactions with some of them thereby carries on business in Australia, even though, depending on precise circumstances, the solicitation may contravene some other Australian law. There is a need for some physical activity in Australia through human instrumentalities, being activity that itself forms part of the course of conducting business.
81 The Full Court in Valve was disinclined to accept the reference to human instrumentalities. As it said at [149]:
Although Gebo Investments concerned different statutory provisions, we consider the discussion of principles regarding carrying on business generally to be of assistance for present purposes. We do not, however, see the reference to "human instrumentalities" in the last sentence of [33] as laying down an inflexible rule or condition as to the circumstances in which an overseas company may be taken to be carrying on business in Australia. We would instead place emphasis on the statement at [31] of Gebo Investments that the case law makes clear that the territorial concept of carrying on business involves acts within the relevant territory that amount to, or are ancillary to, transactions that make up or support the business.
82 What Barrett J had said at [31] was this:
It is my opinion that the circumstances outlined are, of themselves, insufficient to constitute the carrying on of business in Australia. Case law makes it clear that the territorial concept of carrying on business involves acts within the relevant territory that amount to or are ancillary to transactions that make up or support the business. Many of the cases concern persons acting as agents within the jurisdiction of enterprise bases and operating outside the jurisdiction. One view has traditionally been taken where the agent within the jurisdiction has authority to bind the principal to dealings there; while another view has been taken of cases in which the agent is empowered to do no more than receive proposals or orders within the jurisdiction (often, no doubt, in response to solicitation there) and retransmit them to the principal. The distinction is discussed in several cases, including Okura & Co Ltd v Forsbacka Jernverks Aktiebolag [1914] 1 KB 715. Buckley LJ, speaking of a situation of the latter kind, there said (at p 721):
These being the facts, 101, Leadenhall Street is really only an address from which business is from time to time offered to the foreign corporation; the question whether any particular business shall or shall not be done is determined by the foreign corporation in Sweden and not by any one in London. In my opinion the defendants are not "here" by an alter ego who does business for them here, or who is competent to bind them in any way. They are not doing business here by a person but through a person. That person has to communicate with them, and the ultimate determination, resulting in a contract, is made not by the agents in London, but by the defendants in Sweden. It follows from this that one of the essential elements which must be present before a writ can be served in this country on the agent of a foreign corporation is lacking in this case. This appeal must, therefore, be dismissed.
83 The application of the test enunciated at [149] of Valve requires a focus on the transactions making up the business. As I explain in the next section, the transactions which make up Facebook Inc's business of providing data processing services to Facebook Ireland include the installation and removal of cookies in Australia and the management for Australian developers of the Facebook login as part of the Graph API. I therefore do not accept that the discussion in Gebo, as qualified by what this Court said in Valve, assists Facebook Inc although I do accept that Valve requires one to identify with precision the nature of the transactions said to constitute the business.
84 Facebook Inc also submitted that the result in Valve could be distinguished from this case inter alia because there was no doubt in that case that physical assets (servers) were located in Australia. I accept this submission. The precise holding in Valve says nothing about this case. However, I do not think that this provides a good reason for not applying what was said at [149]. In terms of outcome, I do not think that Gebo throws much light on the current situation.