The Administrative Appeals Tribunal (AAT) has significantly
refined the test for determining whether a piece of information is
"personal information". The decision in Telstra
Corporation Limited v Privacy Commissioner in December 2015
shows that it's important to look at the purpose of the
information when classifying it and confirms a two-step test to
determine personal information, which is:
whether the information is about an individual, and
if so, whether the relevant individual can be reasonably
The case involved mobile network data, including metadata,
relating to Mr Grubb's mobile phone. By the date of the
hearing, the information in issue had been narrowed to "call
network data retained by Telstra in relation to communications
passing through its mobile networks".
Mr Grubb had successfully argued before the Privacy Commissioner
that, though difficult, it was theoretically possible to link the
network data to Mr Grubb and thus the information was personal
information. Telstra appealed the decision to the AAT.
Deputy President Forgie set out the above test for when
information is personal information and provided the following
guidance for answering the two key questions:
Determining whether the information or opinion is about an
individual requires an analysis of the subject matter of that
material to conclude whether the connection is too tenuous.
In determining whether the relevant individual can be
reasonably identified, the analysis of the information or opinion
needs to take into account general knowledge, but not the wide
range of information and means of searching information available
in the public arena.
Applying this to the mobile network data in question, the Deputy
President noted the material:
records transactions occurring between mobile devices and the
network to manage the function of the devices, and
establishes, maintains or disconnects connections between the
mobile devices and the desired communication destination.
Although it was noted that, the data would not have been
generated but for Mr Grubb making calls or sending SMS or MMS
messages, on the proper analysis, the data was not about Mr Grubb
but was actually about the way Telstra delivers calls or
What this means for agencies
This is a significant refinement of the test for when
information is classified as personal information. Often it is
assumed that any link, no matter how tenuous, will result in
information being classified as personal information. This
decision, however, highlights that a deeper analysis of the purpose
of the information is required before making such a
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Privacy issues require a considered strategy where sets of big data come with ever-increasing regulatory obligations.
Some comments from our readers… “The articles are extremely timely and highly applicable” “I often find critical information not available elsewhere” “As in-house counsel, Mondaq’s service is of great value”
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).