Australian Court Rules on What Is Considered ‘Personal Information’

    Mar 22, 2017

    In a landmark ruling, the Australian Court has issued its interpretation of Australian privacy law and what qualifies as “personal information.”

    The ruling in a metadata case served as a rebuff to Australian Privacy Commissioner Timothy Pilgrim, who had fought to secure a broad definition of personal information in the courts, to ensure that everything that could reasonably be used to identify an individual would be protected by the Privacy Act.

    Pilgrim warned earlier this year that the case would set the parameters for “arguably the most important term in the Privacy Act.” And indeed, the case grew into a precedent-setting battle over how far the reaches of the Privacy Act extend.

    However, the ruling establishes a narrower definition of personal information than the commissioner wanted. The federal court dismissed the commissioner’s appeal and sided with Telstra and the Administrative Appeals Tribunal (AAT) over whether Telstra needed to hand a full suite of telecommunications metadata over to Telstra customer and former journalist Ben Grubb, under the personal information access provisions of the act, iTnews reported.

    According to iTnews, the battle to define “personal information” began in 2013 when Grubb first asked Telstra for a copy of the metadata information it stored about him in an effort to find out what could be captured under since-passed data retention laws proposed by the federal government.

    Under the Privacy Act, consumers have the right to demand the personal information a private sector organization holds about them and that the organization deliver it to them in the manner they request “if it is reasonable.”

    Telstra had refused to provide phone network data such as the IP address, URLs visited on the account, cell tower locations during web use, and data related to inbound calls, arguing that it does not constitute personal information and thus falls outside the act.

    At question was whether metadata stored by Telstra was information “about” Ben Grubb or “about” the service delivered to him.

    The AAT originally ruled that “the mobile network data relates to the way in which Telstra delivers the service or product for which Mr. Grubb pays ... It is information about the service it provides to Mr. Grubb but not about him."

    Grubb, who is no longer a practicing journalist, told iTnews he was grateful to the Office of the Australian Information Commissioner for pursuing the case, even though he was disappointed in the outcome.

    “The point of this case was to get my telco to hand over what they were already providing to law enforcement agencies on a case-by-case basis,” he said. “In effect, the case achieved most of this, with Telstra eventually allowing consumers to access a lot of what they had on file about their users.”

    But privacy experts say the ruling may have made the privacy landscape even murkier.

    “I think the Privacy Commissioner’s lawyers played a high stakes game with a narrow approach to this appeal, and it backfired on them,” Salinger Privacy's Anna Johnston told iTnews. “The Federal Court did not clearly answer the question of what defines personal information because they were not asked to.”


    © 2017, ARMA International