Australian Privacy Commissioner Timothy Pilgrim will not appeal a Federal Court decision that confirmed a ruling by the Administrative Appeals Tribunal (AAT) limiting the ‘metadata’ Telstra is compelled to hand over to an individual if that individual requests access to it.
The Privacy Commissioner had appealed an AAT decision in a case involving former Fairfax journalist Ben Grubb’s attempt to access a range of data related to his mobile service with Telstra.
Grubb engaged in a protracted battle with Telstra to access a range of the data available to law enforcement organisations, including a significant amount covered by Australia’s data retention regime.
The data sought included cell tower logs, inbound call and text details, the duration of mobile data sessions and phone calls, and the URLs of websites he visited.
Telstra eventually agreed to hand over some but not all the data Grubb requested. However, a ruling by Pilgrim would have forced the telco to hand over all of the data sought by the journalist. Telstra took the Privacy Commissioner’s ruling to the AAT, which sided with the telco.
The AAT ruled that a range of the data did not constitute personal information about Grubb. For example, the IP address allocated to an individual’s smartphone for a period did not constitute personal information and thus Telstra was not required to hand it over upon request.
The Federal Court in January declined to overturn the AAT’s ruling. In its decision, the court did not take a stance on whether a range of the data involved in the case specifically constituted information about Grubb.
The majority ruling stated that it “is unnecessary in this case to descend to the detail of whether any of the requested information was ‘personal information’ or not.”
The judgement said: “Nor is it necessary to canvass the numerous hypothetical examples concerning whether information is ‘about’ an individual or not. There was no ground of appeal which alleged that the AAT erred in its conclusion that none of the information was about Mr Grubb. In other words, the Privacy Commissioner did not seek to establish that any of the information was about Mr Grubb. The appeal was argued only at the high level of generality concerning whether the AAT was correct to give content to the words [‘about an individual’].”
In a statement released today by the Office of the Australian Information Commissioner, Pilgrim said that the judgement “provides important guidance as to what is ‘personal information’ in the terms of the Privacy Act 1988.”
The statement added: “In particular, the Court has confirmed that assessing what is ‘personal information’ requires ‘an evaluative conclusion, depending on the facts of any individual case” and that ‘even if a single piece of information is not ‘about the individual’ it may be about the individual when combined with other information’. This is consistent with how ‘personal information’ has been interpreted by my office.
“On review of the judgment, I have therefore decided not to pursue further appeal in this matter. Obtaining clarity for business and agencies about the definition of personal information was my primary interest in the appeal.”
Pilgrim said that his office was developing additional guidance for businesses and government agencies on applying the definition of personal information.
