In Harder v Proceedings Commissioner [2000] 3 NZLR 80 (CA) – while noting what constituted ‘personal information’, defined as “information about an identifiable individual” for the purposes of the Privacy Act 1993, was not at issue in the case and remained “open for determination when it directly arises” – the Court of Appeal warned “An unqualified approach to what constitutes ‘information about an identifiable individual’ will lead readily to breaches of one or more of the information privacy principles”. The “unqualified approach” adds significantly to the Act’s regulatory costs – both in compliance, and in remedies for interferences with privacy. No appellate judgment since has interpreted the meaning of the Act’s ‘personal information’.
Last week, the Full Court of the Federal Court of Australia took a nuanced approach to the meaning of ‘personal information’ in Privacy Commissioner v Telstra Corporation Ltd [2017] FCAFC 4. A journalist asked Telstra to provide him with information it held under Australian data retention legislation, obtained from his mobile phone activity. Telstra acknowledged he was entitled under Australian privacy legislation to ‘personal information’, then defined as being “about an individual whose identity is apparent, or can reasonably be ascertained, from the information”. But Telstra resisted providing some network data from the calls, including IP addresses and URLs, transited cell tower locations, and incoming call records, as not being about the journalist.
The Privacy Commissioner argued it was enough the journalist could be identified from information held by Telstra, to make all the information ‘about’ him – in other words, information was ‘about’ an individual if it enabled identification of the person; the word ‘about’ was redundant. The Court held an “evaluative conclusion” was required as to whether any particular information was ‘about’ the individual, and then whether causatively that was so ‘from’ the information itself: “The words ‘about an individual’ direct attention to the need for the individual to be a subject matter of the information”. Telstra could also have withheld other information, such as the colour of the journalist’s mobile phone and its network type, as not being ‘about’ the journalist. As in Harder, the Court warned a less discriminating approach risked defeating clear legislative intent to focus on the connection with the individual in establishing rights and obligations under the legislation.
The Australian judgment offers important qualifications for construing the New Zealand legislation. First, the Australian definition is also an available parsing of its New Zealand counterpart: “identifiable” adds nothing to information “about an… individual” unless it means ‘identifiable’ from the information. And second, ‘about’ requires the individual to be a subject of the information. The individual’s identification from the information is a necessary but insufficient condition to render the information ‘personal information’ susceptible to the Privacy Act’s requirements. Other qualifications may also be available from the Act’s context: for example, by ‘about’ may be meant at least capable of collection from, or correction by, the individual concerned (Privacy Principles 2 and 7).
[This article was first published in The Capital Letter (40/1, 24 January 2017)]
Pheroze Jagose 