So, I lodged a question with the Privacy Commissioner about this Facebook issue. It seems that a company can operate via the internet to Australians without having to meet any of Australia’s privacy laws.

I still believe that in this case information is being collected about an individual without that individual’s permission, and given the global pervasiveness of the internet, it is reasonable to expect individual country’s privacy laws to extend to situations that information is provided from their country, even if it is not housed in that country.

My investigation will continue…

Here’s the full response from the Privacy commissioner:

“Thank you for your enquiry and concern about privacy issues relating to Facebook. I understand your concerns, however it is not a matter this Office can assist with.

The Privacy Act 1988 (Cth) (the Act) contains 10 National Privacy Principles which regulate the way personal information is managed by many Australian private sector organisations.

Jurisdiction of the Act

The Act is limited in how it applies to organisations outside Australia. Generally speaking, an individual’s personal information will be protected by the Act when collected, used, stored and disclosed in Australia by organisations bound by the Act.

For Facebook to have obligations under the Act, the organisation must satisfy the requirements of section 5B of the Act,  which broadly relates to whether the organisation carries on business in Australia, and collects or holds personal information in Australia.

Facebook, as a US-based company, is not currently considered to be ‘carrying on business’ in Australia, and does not appear to collect or store information in Australia.  As such, the organisation does not meet the requirements of s5B, which has the effect of excluding its overseas acts and practices from the requirements of the Act.

Please note however, that Facebook may at any time in the future become subject to the requirements of the Act, if their business operations in this country change to the extent that they would be considered to be carrying on a business in Australia and collecting or holding information in Australia (i.e. meeting s5B(3) requirements).

I hope that this response clarifies the current situation with regards to Facebook and the Act.”