In Telstra Corporation Limited and Privacy Commissioner [2015] AATA 991 the Administrative Appeals Tribunal set aside the determination of the Commonwealth Privacy Commissioner that mobile network data from an individual’s phone activity was ‘personal information’ under the Privacy Act 1988 (Cth) which the complainant Mr Grubb was entitled to access. The AAT also declared that Telstra did not breach National Privacy Principle 6.1 (now APP 2.1). (Background)

Essentially the AAT decided that ‘personal information’ must be information ‘about an individual’. Information will not meet the threshold of being ‘about an individual’ merely because an organisation creates the information in order to provide a service to an individual.

Deputy President S A Forgie concluded:

“…it may, but not always, be possible to identify a particular Telstra customer by reference to the mobile network data and other data it maintains. That fact does not necessarily lead to the conclusion that the mobile network data is personal information. Whether it is personal information depends upon its characterisation as being about an individual for that is what the definition of “personal information” requires. Mr Grubb submitted that, but for his making his calls or sending his SMS or MMS messages, particular data in Telstra’s mobile network data would not have been generated. That is true but it does not detract from the characterisation task that I am required to undertake. Is the information about an individual being, in this case, Mr Grubb or is it about something else? If the outcome of that characterisation is that it is not information about an individual, Telstra will not, as Mr Grubb submitted, be required to keep it secure under the Privacy Act. That is an outcome that would follow from the application of the definition in the particular circumstances of the case.

Had Mr Grubb not made the calls or sent the messages he did on his mobile device, Telstra would not have generated certain mobile network data. It generated that data in order to transmit his calls and his messages. Once his call or message was transmitted from the first cell that received it from his mobile device, the data that was generated was directed to delivering the call or message to its intended recipient. That data is no longer about Mr Grubb or the fact that he made a call or sent a message or about the number or address to which he sent it. It is not about the content of the call or the message. The data is all about the way in which Telstra delivers the call or the message. That is not about Mr Grubb. It could be said that the mobile network data relates to the way in which Telstra delivers the service or product for which Mr Grubb pays. That does not make the data information about Mr Grubb. It is information about the service it provides to Mr Grubb but not about him.

I have considered also the IP address allocated to the mobile device which Mr Grubb used. On the basis of the evidence of Mr Tracey and the Operations Manager, I am satisfied that an IP address is not information about an individual. Certainly, it is allocated to an individual’s mobile device so that a particular communication on the internet can be delivered by the Internet Service Provider to that particular mobile device but, I find, an IP address is not allocated exclusively to a particular mobile device and a particular mobile device is not allocated a single IP address over the course of its working life. It changes and may change frequently in the course of a communication. The connection between the person using a mobile device and an IP address is, therefore, ephemeral. In the context of this case, it is not about the person but about the means by which data is transmitted from a person’s mobile device over the internet and a message sent to, or a connection made, with another person’s mobile device.”