Australia: Information Commissioner commenced civil penalty proceedings against Meta over alleged improper disclosure of personal information to Cambridge Analytica

On 9 March 2020, the Office of the Australian Information Commissioner (OAIC) commenced Civil Penalty Proceedings and concluded the investigation initiated on 5 April 2018 under section 40(2) of the Privacy Act 1988 (Cth). The investigation had been launched in response to reports that the personal information of Australian Facebook users may have been improperly disclosed to Cambridge Analytica (UK) Ltd via the “This is Your Digital Life” application. The investigation examined the conduct of Meta, Meta Platforms Ireland Limited, and Facebook Australia Pty Ltd in relation to their compliance with the Australian Privacy Principles (APPs), with specific concerns regarding potential breaches of APPs 1.2 (open and transparent management), 5 (notification of collection), 6 (use or disclosure), 10 (quality of personal information), and 11 (security of personal information). The OAIC alleged that Meta’s systems and practices may have resulted in serious or repeated interferences with the privacy of Australian individuals, contrary to section 13G of the Privacy Act, thereby warranting the commencement of civil enforcement proceedings.