A full bench of the Federal Court has today handed down a hotly awaited judgment on its interpretation of Australian privacy law, and what qualifies as personal information.
It has served a rebuff to Australian Privacy Commissioner Timothy Pilgrim, who has been fighting to secure a broad definition of personal information in the courts, to ensure that everything that could reasonably be used to identify an individual will fall under the protection of the Privacy Act.
But federal court judges today dismissed the commissioner's appeal, siding with Telstra and the Administrative Appeals Tribunal over whether the telco needs to hand a full suite of telecommunications metadata over to Telstra customer and former Fairfax journalist Ben Grubb, under the personal information access provisions of the Act.
The case has hinged on whether metadata stored by Telstra is information “about” Ben Grubb or “about” the service delivered to him.
Telstra held out out on handing over phone network information such as the IP address, URLs visited on the account, cell tower locations during web use, and data pertaining to inbound calls, arguing it does not constitute personal information and thus falls outside the Act.
The AAT originally ruled that “the mobile network data relates to the way in which Telstra delivers the service or product for which Mr Grubb pays ... It is information about the service it provides to Mr Grubb but not about him".
Privacy Commissioner Timothy Pilgrim warned earlier this year that the case would set the parameters for “arguably the most important term in the Privacy Act”.
Today's ruling establishes a narrower definition of personal information than the Privacy Commissioner would like.
His office declined to comment on the ruling while it considers the decision.
Privacy analyst and Lockstep consultant Stephen Wilson said the ruling has potentially made the privacy landscape even more confusing.
“This has been a deeply philosophical semantic argument about the word ‘about’ when we should be arguing the big picture stuff,” he said.
“It has created some artificial parameters. Telstra itself appeared to concede during the case that the information was personal information but was forced to backtrack by semantic nonsense.
“Uncertainty will allow people to continue to cloud the issues,” he told iTnews.
Salinger Privacy's Anna Johnston said cases like this had "led us nowhere, good or bad" - pointing out that it was still unclear if the ruling has any bearing on a new version of the Privacy Act that took effect in 2014.
"I think the Privacy Commissioner’s lawyers played a high stakes game with a narrow approach to this appeal, and it backfired on them.," she said.
"The Federal Court did not clearly answer the question of what defines personal information because they were not asked to."
The battle to define ‘personal information’ dates back to 2013, when Grubb first applied to Telstra for a copy of the “metadata” information it stored on him in an effort to find out what could be captured under since-passed data retention laws proposed by the federal government.
The Privacy Act gives consumers the right to demand the personal information a private sector organisation holds on them, and to deliver it to them in the manner they request “if it is reasonable to do so”.
But the case has grown into a precedent-setting battle over how far the reaches of the Privacy Act extend.
The privacy commissioner had disputed Telstra's approach through a network of courts, escalating the matter via appeal to the full bench of Federal Court to reach today's ruling.
Grubb - who has since left journalism - told iTnews he was grateful to the OAIC for pursuing the case, despite being disappointed in the outcome.
"The point of this case was to get my telco to hand over what they were already providing to law enforcement agencies on a case-by-case basis," he said.
"In effect, the case achieved most of this, with Telstra eventually allowing consumers to access a lot of what they had on file about their users."
