Is it about you?

The Federal Court has determined that the definition of "personal information" in the Privacy Act 1988 (Cth) (the Privacy Act) is confined to information "about" an individual.  The effect of the decision is to confine the scope of the Privacy Act, as it will not extend to all information which can be linked to an individual.

The Federal Court provided the following guidance on how to determine if information is about an individual:

• information can have multiple subject matters;
• whether information is about an individual may be determined by other available information; and
• each case will need to be considered on its own facts.

The effect of this decision will only become clear over time as it is implemented.  It appears likely, however, that its overall effect will be to reduce the cost of Privacy Act compliance for some organisations.

The decision considered the definition of "personal information" prior to the 2014 amendments to the Privacy Act, but is relevant because the definition of "personal information" in the current version of the Act still contains the words construed by the Court.  

Background 

On 15 June 2013, Mr Ben Grubb, journalist for Fairfax (Grubb) sent Telstra Corporation Limited (Telstra) a request for "all the metadata information Telstra has stored" about him in relation to his mobile phone service, including cell tower logs, inbound call and text details, duration of data sessions and telephone calls, and the URLs of websites visited.

On 16 July 2013, Telstra notified Grubb that he could access outbound mobile call details and the duration of data sessions via the online billing system. Otherwise, Telstra declined to provide the additional information, which it referred to as "mobile network data", citing privacy laws and advised that Grubb would need a subpoena for the remainder of the information to be disclosed. 

On 8 August 2013, Grubb lodged a complaint with the Office of the Australian Information Commissioner under section 36 of the Act, seeking a declaration that Telstra meet its access obligations under the Act.

On 1 May 2015, the Privacy Commissioner made a determination that Telstra had breached the Privacy Act by failing to provide Grubb with access to the mobile network data on the basis that it was his personal information.

Telstra appealed the determination of the Privacy Commissioner to the Administrative Appeals Tribunal (AAT).  The AAT subsequently held that the mobile network data held by Telstra was not "personal information" for the purposes of the Privacy Act.  This was because the mobile network data was not information "about an individual" as required by the Act.

The Privacy Commissioner appealed the decision of the AAT to the Full Bench of the Federal Court of Australia.

Outcome

In the Federal Court, three of the grounds of appeal looked at the meaning of what is "personal information about an individual".  That meaning is pertinent to determining whether or not National Privacy Principle 6.1 (since replaced by Australian Privacy Principle 12) has been complied with.  Relevantly, NPP 6.1 requires that "If an organisation holds personal information about an individual, it must provide the individual with access to the information on request by the individual" (subject to specified exceptions).

In this case, the Privacy Commissioner alleged that Telstra had failed to comply with NPP 6.1 when it did not provide Grubb with access to the mobile network data he requested.

The definition of "personal information" under consideration was "information or an opinion (including information or an opinion forming part of a database), where true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion".

The Court acknowledged that what might be considered to be "personal information" is very broad.  However, the definition is limited by requirements that the personal information must be:

• held by an organisation (in this case Telstra);

• "about" the individual who requests access (in this case Grubb); and

• about an individual (Grubb) whose identity is apparent or can reasonably be ascertained.

The Court held that information held by an organisation from which an individual's identity could reasonably be ascertained may not always be "personal information about an individual".  For information to fall within the remit of NPP 6.1, it must be information "about an individual".  The Court noted that this requirement might not be difficult to satisfy because information and opinions can have multiple subject matters, and even if a single piece of information is not "about an individual" it might be about the individual when combined with other information.  

However, the Court held that an evaluative conclusion is required, depending upon the facts of each individual case.  Whether information is "about an individual" might depend upon the breadth that is given to the expression ''from the information or opinion".  In other words, "the more loose the causal connection required by the word "from", the greater the amount of information which could potentially be "personal information" and the more likely it will be that the words "about an individual" will exclude some of that information from being personal information" (at [64]).

In this case, Mr Grubb needed to be the subject matter of the information.  For example, when Mr Grubb requested information about the colour of his mobile phone and his network type (3G) – that was not information "about" him.  

Ultimately, the Court held that it did not need to consider:

• whether or not the mobile network data was "personal information"; or

• whether the mobile network data requested by Grubb was "about" Grubb,
• because the Privacy Commissioner had not appealed the decision of the AAT on the grounds that the mobile network data was not information about Grubb.

Looking forward

The decision of the Federal Court may be less helpful than some commentators might have previously foreshadowed, given that the Court was not asked to decide  whether the information Grubb sought was information "about" him and so did not consider this point in detail. 

However, the decision has at least clarified the importance of the words "about an individual" in the context of the application of NPP 6.1 and provided some guidance on the scope of what constitutes personal information.

Authors: Tim Brookes, Partner; Clare Doneley, Counsel; Marlia Saunders, Senior Associate and Jessica Norgard, Lawyer