The term "carrying on a business" may appear straightforward, but there is actually a diverse range of legal definitions that determine if a business is operating within Australia, and therefore what its obligations are. With the always evolving landscape of digital business practices, the grey area of whether certain Australian laws apply to foreign businesses is expanding.
In this article, Lochlan Worrell of Moulis Legal sheds light on when a foreign entity may be "carrying on a business" in Australia, including how the recent judgment of Facebook Inc v Australian Information Commissioner[1] has extended the reach of the Privacy Act 1988.
Why all the carry on?
The phrase “carrying on a business in Australia” is a threshold requirement for a variety of Australian legislation, including the Corporations Act 2001, Privacy Act 1988 and the Competition and Consumer Act 2010 to name a few.
While each of these acts may have distinct definitions and interpretations of this phrase, the consequences remain consistent: the company is bound by obligations under that specific act, irrespective of its foreign registration status.
The Corporations Act
The Corporations Act 2001 (“Corporations Act”) specifies that a foreign company must not carry on a business in Australia unless it is registered, or has applied to be registered, as a foreign company under that Act.[2]
Conveniently, the Corporations Act provides clear definitions of what constitutes “carrying on a business”, and what does not. It specifies that a body corporate is deemed to be carrying on a business if it:
- has a place of business in Australia; or
- establishes or uses a share transfer office or share registration office; or
- administers, manages, or otherwise deals with, property situated in Australia, as an agent, legal personal representative or trustee, whether by employees or agents or otherwise.[3]
Helpfully, the Corporations Act also specifies that certain activities will not on their own, be sufficient to be deemed to be carry on a business in Australia. This includes:
- being a party to Court proceedings;
- holding a meeting of directors or shareholders; or
- maintaining a bank account or conducting an isolated transaction that is completed within a period of 31 days.
Obligations imposed on foreign companies by the Corporations Act are significant, and include mandatory registration, maintaining a registered office in Australia, appointing a local agent, financial reporting and notifying ASIC of changes to their corporate details.
The Competition and Consumer Act
The Competition and Consumer Act 2010 (“CCA”) promotes fair competition and safeguards consumer rights in Australia. While the CCA ordinarily applies to acts done in Australia, certain provisions[4] extend to conduct outside Australia by “bodies corporate incorporated or carrying on business within Australia”.[5]
Unlike the Corporations Act however, the CCA does not expressly define the term “carrying on a business”.
As a result, interpretation of the phrase “carrying on a business” for the purposes of the CCA has fallen to the Courts in cases like Valve Corporation v Australian Competition and Consumer Commission[6] (“Valve”). In that case, Valve was alleged to have breached s18 and s 29(1) of the Australian Consumer Law[7]. Valve was found to be carrying on business in Australia despite being a U.S. corporation based in Washington State, hosting its website in Washington State, having no employees or physical presence in Australia.
The Court made it’s finding on the basis that Valve:
- had approximately 2.2 million Australian accounts from which it earned significant ongoing revenue;
- “deposited” content on Australian servers for use by Australian users;
- owned approximately $1.2 Million of personal property and servers in Australia;
- incurred significant monthly expenses in Australia running and maintaining those servers;
- maintained relationships with Australian third party content delivery providers; and
- was party to contracts with third party service providers in Australia.
As one of Australia’s leading regulatory bodies, the Australian Competition and Consumer Commission’s approach to enforcement of the CCA is strong and swift.
For this reason, it is critical that companies who may be subject to the provisions of the CCA both understand and comply with their obligations to avoid being subject to significant financial, regulatory and, in some cases, criminal penalties. See our recent article here on how significant penalties under the CCA can be.
The Privacy Act
The provisions of The Privacy Act 1988 ("Privacy Act") safeguard the personal information and data of Australians, and apply to the actions and practices conducted outside Australia by any organisation, which has an "Australian link".[8]
While that Australian link can be established by a range of traditional considerations, such as being a body corporate incorporated in Australia, it can also be established where an organisation does not meet those traditional tests but are nonetheless considered to be carrying on a business in Australia.[9]
This can have far-reaching implications for international entities, particularly in the digital age, where data and information cross borders seamlessly.
Like the CCA, the Privacy Act does not provide a specific definition of "carrying on a business", and instead relies on the Courts to interpret this phrase.
The Full Court of the Federal Court considered this very issue in the context of the Privacy Act recently in the case of Facebook Inc v. Australian Information Commissioner. The question centred around whether Facebook was "carrying on a business" for the purposes of the Privacy Act.
In that decision, the Full Court underscored the extensive reach of the Privacy Act, finding a prima facie case that despite having no physical assets, customers or revenues in Australia, Facebook was carrying on a business because it:
- installed and managed cookies on the physical devices of Australian users; and
- provided certain functionality to Australian developers through its Graph API.
This finding is a timely reminder that regardless of an entity’s physical location, if it collects, stores, or process personal information of Australian individuals as part of its activities, it may be subject to the Privacy Act.
Conclusion
The concept of "carrying on a business" is a critical threshold requirement for numerous regulatory frameworks in Australia.
Recent legal developments, exemplified by the cases mentioned above, highlight the evolving nature of this phrase, and emphasise the need for businesses to remain informed and compliant with Australian laws.
Businesses currently operating or considering operating in Australia should seek tailored advice to ensure they understand the nuances of the term “carrying on a business” and how it affects their business operations and obligations.
This memo presents an overview and commentary of the subject matter. It is not provided in the context of a solicitor-client relationship and no duty of care is assumed or accepted. It does not constitute legal advice.
© Moulis Legal 2024
[1] [2022] FCAFC 9.
[2] Corporation Act 2001 (Cth), s 601CD,
[3] Corporation Act 2001 (Cth), s 21.
[4] Provisions which extend to conduct outside Australia are defined by section 5(1) and include: Part IV; Part IVBA, Part IVE, Part XI, Part XICA, the Australian Consumer Law (other than Part 5-3) and the remaining provisions of the Act (to the extent to which they relate to any of the provisions covered by Part IV; Part IVBA, Part IVE, Part XI, Part XICA).
[5] Competition and Consumer Act 2010 (Cth), s 5.
[6] [2017] FCAFC 224.
[7] Competition and Consumer Act 2010 (Cth) sch 2 ('Australian Consumer Law').
[8] The Privacy Act 1988 (Cth), s 5B.
[9] Ibid.
