The full Bench of the Federal Court has ruled against the Australian Privacy Commissioner’s attempt to have metadata classified as personal information.
In basic terms, metadata is data that describes other data. For example, information about the size, resolution and creation date of an image is metadata about that image.
Personal information is defined under The Privacy Act 1988 (“Privacy Act”) as “information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified individual, or an individual who is reasonably identifiable”.
So why are we talking about metadata?
Back in 2013, Ben Grubb (a former Fairfax journalist) requested that Telstra provide him with access to metadata associated with his mobile phone service he had with Telstra, claiming it was his personal information to which he had a right to access. The reason? The Australian Government was about to introduce mandatory data retention laws, where telcos like Telstra would need to retain metadata for 2 years in the event that law enforcement needed to access it.
Telstra initially told Mr Grubb that he would be able to access data including outbound mobile phone calls and lengths of data sessions through Telstra’s billing portal available online – but Mr Grubb wanted access to data including inbound call and text details, phone call duration and logs of cell towers he was connected to at any given time (his geolocation data). Mr Grubb was told that unless he filed a subpoena, such information would not be provided to him. As a result, he filed a complaint with the Privacy Commissioner on the basis that Telstra was refusing him access to his personal information.
Telstra then handed over some of the data that Mr Grubb was seeking, but refused to hand over mobile network data on the basis that this was not personal information. This was because Telstra considered that Mr Grubb’s identity was not apparent, nor could it be reasonably ascertained, from such metadata.
In May 2015, the Privacy Commissioner ruled that metadata was personal information (due to the ability to identify a person through cross-matching data like geolocation data with other datasets), and by Telstra not providing it to Mr Grubb, they breached National Privacy Principle 6.1 (now replaced by Australian Privacy Principle 12) which states, “if an organisation holds personal information about an individual, it must provide the individual with access to the information on request by the individual”.
So why do we still not have access to metadata?
Telstra appealed the Privacy Commissioner’s determination to the Administrative Appeals Tribunal (“AAT”), who set aside the determination. The AAT found that there was no breach of NPP 6.1 by Telstra because according to the AAT, mobile network data was about connections between mobile devices as opposed to data ‘about’ an individual.
It determined that once Mr Grubb’s call or message was transmitted from the first cell that received the call or message from Mr Grubb’s mobile device, the data generated was directed to delivering the call or message to its intended recipient, and was no longer about Mr Grubb. The AAT determined that in effect, such data is about the way in which Telstra delivers the call or message.
The Privacy Commissioner then decided to appeal the AAT’s decision, but on very narrow grounds. The Privacy Commissioner argued that the phrase ‘about an individual’ in the definition of personal information should be ignored as it did not have substantive operation in the definition of personal information.
The decision of the Federal Court was therefore the result of focusing on the statutory interpretation of the words ‘about an individual’. It determined that such words had substantive operation in the definition of personal information. As a result, the AAT’s determination on metadata not being considered personal information remained.
It is important to note that the Federal Court stated that information and opinions can have multiple subject matters, and had this been argued by the Privacy Commissioner on appeal to the Federal Court, metadata may very well have been considered to fall under the definition of personal information to which we would have access.
For more information on this, and how it can affect you or your business, please contact us.
