The Meaning of Personal Information

In the recent case of The Privacy Commissioner v Telstra Corporation Limited [2017] FCAFA 4, the question was raised as to whether the words “personal information” had any bearing on what information an individual could request from an organisation under the Privacy Act 1988 (Cth) (Act).

The question came about in Telstra Corporation Limited v Privacy Commissioner [2015] AATA 991 after it was heard that Mr Grubb had requested from Telstra all personal information in relation to his telephone service.  Telstra provided to Mr Grubb various pieces of information, however refused to give him metadata in relation to his service.  On 1 May 2015 the Privacy Commissioner held that the metadata was “personal information” required to be given to Mr Grubb under the National Privacy Principle (NPP) 6.1.  Telstra took to the court to have the matter determined.

In the trial decision the court held that:

• the Act applies to the collection of personal information by an organisation collected for inclusion in a record or a generally available publication;
• NPP 6 required personal information to be disclosed to the person to whom the information relates and that has requested the information except where, compliance by the organisation would:
  • place an unreasonable administration burden on the organisation; or
  • cause the organisation unreasonable expense; and
• personal information was defined in section 6(1) of the Act as information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Section 187LA of the Telecommunications (Inception and Access) Act 1979 (Cth) later extended the meaning of personal information in relation to telecommunication services.  It states that the Act will apply to information that relates to:

• the individual; or
• a communication to which the individual is a party.

It does not require a service provider to keep information that is:

• the contents or substance of the communication;
• an address to which the communication was sent on the internet; or
• any information that passes over the top of the service that they provide.

Counsel for Telstra submitted (and the Court agreed) that:

• Mr Grubb’s identity was not apparent from, and could not be reasonably be ascertained from, mobile network data in relation to his mobile telephone service;
• the mobile network data was not “personal information”;
• providing Mr Grubb with the information requested would have an unreasonable impact upon the privacy of other individuals; and
• Mr Grubb’s identity was not apparent and could not be easily ascertained when regard was had solely to the mobile network data, as it contained no reference to the customer’s name or telephone number. The only way the identity of an individual could be ascertained from the mobile network data would be to consider and pair it with other information that is not publically available.

The Meaning of the Privacy Principle

Dowsett J reasoned in the appeal, that the “underlying intention of National Privacy Principle 6 is to ensure that a person has access to information held by a relevant entity, which information may become known to third parties”.

It was held that it would be necessary to consider each piece of personal information requested, either individually or in conjunction with other items, to determine if the information is about the individual.  Just as a determination is required to be made as to whether the identity of a person can be reasonably ascertained.

The case did not define when metadata would be about an individual, however held that the words “about an individual” as incorporated in the National Privacy Principle 6 and the Act were substantial in determining what information a company is required to give to an individual who requests their personal data.

Links and further references

Legislation

Telecommunications (Inception and Access) Act 1979 (Cth)
Privacy Act 1988 (Cth)
Australian Privacy Principles

Cases

Telstra Corporation Limited v Privacy Commissioner [2015] AATA 991
The Privacy Commissioner v Telstra Corporation Limited [2017] FCAFA 4

Further information about privacy compliance

If you are a business and need advice on Privacy Law or your requirements to disclosure information under the National Privacy Principles, contact us for a confidential and obligation free and discussion:

Disclaimer

This article contains general commentary only.  You should not rely on the commentary as legal advice.  Specific legal advice should be obtained to ascertain how the law applies to your particular circumstances.

---

Related insights about privacy compliance