Australia's Privacy Act is similar to New Zealand's in some fundamental respects. Both Acts regulate "personal information" held by corporations and government agencies.
And in both countries, "personal information" means information about an identifiable individual.
A decision this week of the Full Federal Court of Australia is being taken as significant on two key aspects of the definition of personal information: whether certain telecommunications metadata is "about an identifiable individual". But the decision didn't address those issues. The Federal Court only decided whether the phrase "about an individual" in the pre-amendment Privacy Act was an important element of the definition.
This is unfortunate because the case was initially about whether the metadata was information about an "identifiable" individual. In that form it provided a great opportunity for some clarity on a key issue - how closely linked to you does information have to be?
The case began when an Australian journalist made a Privacy Act request to his telco for all of his geolocation metadata. The telco provided the information that was stored in its billing system. That included geolocation data for outbound calls but not all of the geolocation data that might exist such as the cell tower a phone was connected to even when no call was being made.
Initially, the telco argued the information wasn't directly cross-referenced against customer IDs and some extra work had to be done to connect it up to an "identifiable" person and so it didn't meet the definition of "personal information".
At first instance the Australian Administrative Appeals Tribunal agreed with the telco. But not for the same reasons. The AAT said the information wasn't "about" the person. The AAT seemed to consider that information can only be about one thing. So if it was about the network, it couldn't be about the person.
Australia's Privacy Commissioner appealed to the Federal Court. But the appeal was narrow and ultimately doesn't go much further.The most helpful comment is this:
"The words ‘about an individual’ direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters”.
But the case doesn't answer the question of whether that particular metadata is "about" a person.Which is a shame because it's a really interesting issue. I am pretty confident information that can identify where my phone is at any time is information about me. Does it really matter if it takes a few steps to link the information to me?
New Zealand's Privacy Commissioner may ultimately have to deal with a similar issue. Unless there is an broad appeal to the High Court of Australia, there won't be much guidance from across the ditch.
Telstra held out out on handing over phone network information such as the IP address, URLs visited on the account, cell tower locations during web use, and data pertaining to inbound calls, arguing it does not constitute personal information and thus falls outside the Act.