Australian Court Rules on What Is Considered ‘Personal Information’

    Apr 11, 2017

    In a landmark ruling, the Australian Court issued its interpretation of Australian privacy law and what qualifies as “personal information.”

    The ruling in a metadata case served as a rebuff to Australian Privacy Commissioner Timothy Pilgrim, who’d fought to secure a broad definition of personal information to make sure everything that could reasonably be used to identify an individual would be protected by the Privacy Act.

    Pilgrim warned earlier this year that the case would set the parameters for “arguably the most important term in the Privacy Act.” And, indeed, the case grew into a precedent-setting fight over how far the influence of the Privacy Act extended.

    The ruling establishes a narrower definition of personal information than Pilgrim wanted. The federal court dismissed his appeal and sided with Telstra and the Administrative Appeals Tribunal (AAT) over whether Telstra needed to hand an amount of telecommunications metadata over to a Telstra customer and former journalist Ben Grubb, under the personal information access provisions of the Act, iTnews reported.

    According to iTnews, the battle to define “personal information” began in 2013 when Grubb asked Telstra for a copy of the metadata it stored about him in an effort to learn what could be captured under since-passed data retention laws proposed by the federal government.

    Under the Privacy Act, consumers have the right to demand the personal information a private sector organization holds about them and that the organization deliver it to them in the manner they request “if it is reasonable.”

    Telstra had refused to provide phone network data such as the IP address, URLs visited on the account, cell tower locations during web use, and data related to inbound calls, arguing that it does not constitute personal information and thus falls outside the Act.

    At question was whether metadata stored by Telstra was information “about” Ben Grubb or “about” the service delivered to him.

    The AAT originally ruled that “the mobile network data relates to the way in which Telstra delivers the service or product for which Mr Grubb pays ... It is information about the service it provides to Mr Grubb but not about him."

    Grubb, who is no longer a practicing journalist, told iTnews he was grateful to the OAIC for pursuing the case, even though he was disappointed in the outcome.

    “The point of this case was to get my telco to hand over what they were already providing to law enforcement agencies on a case-by-case basis,” he said. “In effect, the case achieved most of this, with Telstra eventually allowing consumers to access a lot of what they had on file about their users.”

    But privacy experts say the ruling may have made the privacy landscape even murkier.

    “I think the Privacy Commissioner’s lawyers played a high stakes game with a narrow approach to this appeal, and it backfired on them,” Salinger Privacy's Anna Johnston told iTnews. “The Federal Court did not clearly answer the question of what defines personal information because they were not asked to.”

    The online Global Policy Brief is intended to help you stay current on international news and events. Further information about the issue is accessed by clicking on the link provided at the end of each summary.

    Want to sign up to receive an email version of the Global Policy Brief? It's free! Just tell us a little about yourself and you'll receive a monthly dose of the latest in legislation, regulation, and more.

    © 2017, ARMA International