Australia's courts to rule on landmark definition of 'personal information'

A full bench of the federal court will in August make a landmark ruling on what constitutes ‘personal information’ in the context of Australia's Privacy Act data protection rules.

Timothy Pilgrim (Source: OAIC)

The move was sparked by former Fairfax journalist Ben Grubb's three-year battle to get a hold of his metadata from Telstra.

Appeals and counter-appeals have meant the case has been bounced from tribunal to tribunal due to differences in the definition of what counts as information about Grubb, as opposed to information about his service or his device.

At its heart lies a dispute over whether Grubb's location metadata qualifies as personal information, thereby bringing it within the regulatory parameters of the Act, or whether it is merely ‘network data’ pertaining to the machine-to-machine communication between a device and a cell tower.

Grubb’s initial bid to access his metadata under section 12 of the Privacy Act - which demands organisations hand over any information they hold on an individual upon their request - was knocked back on the grounds that it was not personal information.

But in May 2015 the Privacy Commissioner disagreed with the ruling, arguing the same information could be reasonably linked back to Grubb - or any other hypothetical customer - by cross matching it with another data set. This, the commissioner said, qualified it as personal information.

The matter then went to the Administrative Appeals Tribunal (AAT), which sided with Telstra, and in January this year moved to the federal court through a formal appeal lodged by the Office of the Australian Information Commissioner.

The matter will be decided by a full bench of the federal court in August this year.

Speaking at a privacy awareness week breakfast in Sydney this morning, information commissioner Timothy Pilgrim said the upcoming ruling would shape “arguably the most important term in the Privacy Act”.

He said the AAT’s current stance threatened to significantly shift the operation of the Act and compliance within government and business circles, making a final definition of 'personal information' critical.

“The AAT’s decision presents, potentially, a new and different scope to what is in the Privacy Act," Pilgrim said.

“I firmly believe that clarity and certainty around the definition are critical to operation of the Act and to the fair and reasonable expectations of any business or agency that is required to be accountable to it."

Pilgrim and his office did not comment on whether the OAIC would be prepared to go all the way to the High Court over the definition, should it disagree with the federal court's ruling.