A full bench of the court today ruled that not all metadata generated by an individual was personal data and a company, in this case Telstra, could refuse to hand it over to the individual in question.
In 2013, Ben Grubb, then a technology reporter with Fairfax Media, sought metadata information regarding his mobile phone held by Telstra Corporation.
Telstra refused to provide it to him claiming it was not personal information. He complained to the Privacy Commissioner who held that the metadata was personal information. Telstra successfully appealed that decision in the Administrative Appeals Tribunal in 2015.
The APF said the judgment would be "disastrous for ordinary Australians and misunderstands how a digital footprint identifies a person".
"This decision will severely impair the Privacy Commissioner in regulating privacy online."
APF board member Dr Jake Goldenfein said: "The judgment means that a person's Internet browsing history (URL addresses visited), assigned IP addresses, and geo-location (mobile tower) data is not personal information because it does not identify that person's name or telephone number.
"The reality, however, is that those pieces of information taken together do identify a person. The judgment effectively introduces a new hurdle in determining whether personal information is protected by requiring a person to be the subject matter of each piece of information. This very narrow reading ignores how data matching and data linking works, permitting a person to be identified from pieces of information each of which does not necessarily specifically refer to him or her."
Dr Goldenfein added that the court's approach ignored the effect of significant technological developments in data matching and linking.
"It is an analog decision for a digital age," he said. "The decision leaves Australia with one of the weakest and least effective privacy protections in the Western world.
The court had ignored overseas court decisions which had identified and recognised the reality of linking different items of digital information which has the effect of identifying a person, he said.
"Today's judgment was a bad day for privacy protection in Australia. This data is very valuable to security and law enforcement but there are now no protections for ordinary citizens as to the use of such data," Dr Goldenfein said.
"This judgment has rendered Australia an outlier in the protection of privacy online. It reduces the protections ordinary Australians should expect and have. It is a boon for organisations to collect vast amounts of information about individuals but not be accountable to the regulator for it."