Getting personal—When is information, personal information?22 February 2016
The Administrative Appeals Tribunal (AAT) has significantly refined the test for determining whether a piece of information is "personal information". The decision in Telstra Corporation Limited v Privacy Commissioner in December 2015 shows that it's important to look at the purpose of the information when classifying it and confirms a two-step test to determine personal information, which is:
- whether the information is about an individual, and
- if so, whether the relevant individual can be reasonably identified.
The case involved mobile network data, including metadata, relating to Mr Grubb's mobile phone. By the date of the hearing, the information in issue had been narrowed to "call network data retained by Telstra in relation to communications passing through its mobile networks".
Mr Grubb had successfully argued before the Privacy Commissioner that, though difficult, it was theoretically possible to link the network data to Mr Grubb and thus the information was personal information. Telstra appealed the decision to the AAT.
Deputy President Forgie set out the above test for when information is personal information and provided the following guidance for answering the two key questions:
- Determining whether the information or opinion is about an individual requires an analysis of the subject matter of that material to conclude whether the connection is too tenuous.
- In determining whether the relevant individual can be reasonably identified, the analysis of the information or opinion needs to take into account general knowledge, but not the wide range of information and means of searching information available in the public arena.
Applying this to the mobile network data in question, the Deputy President noted the material:
- records transactions occurring between mobile devices and the network to manage the function of the devices, and
- establishes, maintains or disconnects connections between the mobile devices and the desired communication destination.
Although it was noted that, the data would not have been generated but for Mr Grubb making calls or sending SMS or MMS messages, on the proper analysis, the data was not about Mr Grubb but was actually about the way Telstra delivers calls or messages.
What this means for agencies
This is a significant refinement of the test for when information is classified as personal information. Often it is assumed that any link, no matter how tenuous, will result in information being classified as personal information. This decision, however, highlights that a deeper analysis of the purpose of the information is required before making such a characterisation.