Telstra will not be forced to hand over all the metadata it holds on a former Fairfax journalist, after the Administrative Appeals Tribunal last week overturned a decision by the Australian Privacy Commissioner.
In June 2013, then-Fairfax deputy technology editor Ben Grubb asked Telstra, under obligations in the Privacy Act, to hand over all the metadata it held on him related to his mobile phone, including which cell towers he had been connected to, what numbers he had called or texted, or received calls and texts from, and GPS information.
Telstra responded in July, stating he could only get access to data contained in his bills, and any other information requested would need a subpoena. Grubb complained to the Privacy Commissioner Timothy Pilgrim about Telstra’s response.
Telstra eventually handed over a CD of Grubb’s call records, including his outgoing calls, cell tower information, and SMS information, but not who had called or texted him. The Privacy Commissioner in November 2014 ordered Telstra to hand over all the information it would routinely hand over to government agencies under the data retention scheme.
This was before the Parliament had passed legislation requiring telecommunications companies to keep the data for a period of two years, but the companies were already handing over metadata to government agencies hundreds of thousands of times per year before the legislation passed.
In May this year, the Privacy Commissioner found that Telstra had breached the Privacy Act by failing to provide Grubb with access to his personal information, specifically his IP addresses, web browsing history, and cell tower information. Grubb said he was not interested in the numbers of incoming calls.
At the time, Telstra and other telecommunications companies slammed the decision, arguing it could lead to telcos being forced to retain much more data than had been planned under the mandatory data retention regime.
Telstra appealed, and in a decision this week, the Administrative Appeals Tribunal sided with Telstra, arguing IP addresses assigned to Grubb were not personal information that Telstra needed to hand over under privacy law. Mobile network data, including web browsing history, may not be considered personal information, according to the AAT.
Telstra has subsequently made it easier for customers to access the metadata it holds on them, and ABC journalist Will Ockenden used his own data obtained from Telstra to illustrate the type of data available to government agencies without a warrant under the mandatory data retention regime.
A spokeswoman for Telstra welcomed the decision, stating it clarified the sort of data Telstra was required to keep on its customers.
“The decision supports our view that data which helps us manage communications across our network is not personal information. This means that companies can make sure customers’ personal data is kept secure and is accessible to customers but there is no requirement to hold large quantities of irrelevant data.”
Communications Alliance CEO John Stanton was also pleased with the result, stating the original decision “had the potential to place significant additional administrative and operational burden on the telecommunications sector, without generating any benefit to consumers.”
In the time the Administrative Appeals Tribunal has taken in making its decision, Grubb has left Fairfax for a public relations role. It is understood he is unlikely to appeal the decision.
The AAT’s decision is likely to impact on a pending decision of the Office of the Australian Information Commissioner into whether Crikey can access the personal metadata of Attorney-General George Brandis. The original FOI request to Brandis’ office resulted in just a redacted Telstra phone bill being handed over. Crikey has argued that much more data should be available, such as who Brandis spoke to on the phone, at what time. On appeal, the OAIC indicated it may hand the case to the AAT for decision, which would come with an application fee of over $800.