25 January 2017
Full Federal Court hands down decision on definition of 'personal information'
On 19 January 2017, the Full Court of the Federal Court of Australia handed down its decision in Privacy Commissioner v Telstra Corporation Ltd [2017] FCAFC 4. The decision concerned the interpretation of the definition of 'personal information' in the Privacy Act 1988 and the effect of the words 'about an individual', which are contained in that definition.
The appeal was brought by the Privacy Commissioner from the decision of the Administrative Appeals Tribunal (the Tribunal) in Telstra Corporation Ltd and Privacy Commissioner [2015] AATA 991.
A journalist, Mr Grubb, requested access to all metadata regarding his mobile phone held by Telstra Corporation Ltd. Telstra gave him some information but refused to give him access to its mobile network data, which includes metadata. The Privacy Commissioner decided that the metadata was personal information as Telstra had the capacity to link the metadata with Mr Grubb's account information, which meant Mr Grubb was identifiable.
The Tribunal disagreed, finding that the mobile network data was not information 'about' Mr Grubb. Rather, it was information about the way Telstra provided its services to Mr Grubb. In the Tribunal's assessment, in determining whether information is personal information, it is not enough that an individual is identifiable (e.g. because an agency can link non-identifying information with other identifying information it holds). The information must also say something 'about' that identifiable individual.
Before the Full Court, the Privacy Commissioner argued that the Tribunal had incorrectly applied the statutory test by placing weight on the words 'about an individual' in the definition of personal information. The Privacy Commissioner submitted that, if there is information from which an individual's identity could reasonably be ascertained, and the organisation holds that information, it will always be the case that the information is 'about the individual'.
The question on appeal was limited to the statutory construction of the words 'about an individual' as they applied in the Privacy Act 1988 (Privacy Act)before 12 March 2014. The Full Court was not asked to consider when it could be said that metadata could or would be about an individual.
Full Federal Court decision
The Full Court concluded that the words 'about an individual' in (the former) National Privacy Principle (NPP) 6.1 did have substantive effect and dismissed the appeal.
The Full Court did not agree that the words 'about an individual' in the definition of 'personal information' can be ignored or have no work to do. The words direct attention to the need for the individual to be 'a subject matter' of the information or opinion. While information and opinions can have multiple subject matters, the Full Court said it is necessary in every case to consider whether each item of information requested, individually or in combination with other items, is 'about an individual'. This will require an evaluation of the facts of any individual case, in the same way that an agency is required to determine whether identity can reasonablybe ascertained.
The Australian Privacy Foundation and the New South Wales Council for Civil Liberties applied for leave to be heard as amici curiae. The basis for the application was to put before the Court a range of international materials. The Full Court dismissed the application for leave on the basis that the volume of overseas case law upon which they relied concerned legislation which was worded differently and based upon a different context and background, even though ultimately the case law was derived from the same broadly worded international instruments.
Implications for agencies
The decision has implications for the interpretation of the current definition of personal information in the Privacy Act, which includes the requirement that information be 'about' an individual.
The decision does not mean that metadata, or data that can be linked with other data, can never be 'about' an individual. As the case was decided purely on a question of statutory construction, the Full Court did not given much guidance on how to undertake the evaluative task to determine when information will be 'about' a person. But the decision does resolve that this is a question that must be asked.
Important: The material in Express law is provided to clients as an early, interim view for general information only, and further analysis on the matter may be prepared by AGS. The material should not be relied upon for the purpose of a particular matter. Please contact AGS before any action or decision is taken on the basis of any of the material in this message.
