Telstra breached Australian privacy law when it failed to hand over a journalist’s metadata to him, a watchdog has ruled.

A Fairfax journalist, Ben Grubb, has been in a two-year battle to access details of his phone and web metadata from Telstra. Under Australian privacy law, certain corporate and government entities must hand over “personal information” they hold on individuals.

Although Telstra provided some data to Grubb, it refused to hand over information about internet protocol address information, edited versions of incoming call records and website URL information.

But the Australian privacy commissioner, Timothy Pilgrim, said in a landmark ruling on Monday that the URL and IP information must be provided to Grubb within 30 days, and free.

“I therefore find that in the present set of circumstances, the metadata held by Telstra to which it refuses to give the complainant access (the so named ‘network data’) constitutes the complainant’s personal information under the Privacy Act,” he said.

Telstra said it would appeal against the decision.

Pilgrim ruled the incoming call record data was subject to an exemption under the Privacy Act that allowed Telstra to refuse access to the information.



In his decision he rejected a number of claims made by Telstra about the difficulty in retrieving and linking data to a person’s identity. Telstra relied in part on this submission to argue that certain types of Grubb’s data was not “personal information” because it could not be linked to his identity.

He drew attention to Telstra’s provision of data to law enforcement agencies to show that it has the ability to process and connect different types of metadata to individuals.

“Telstra’s handling of tens of thousands of requests made by law enforcement bodies, together with its recent public statement affirming that customers may access their metadata on request, suggests instead that Telstra has the capacity through the use of its network and records management systems to ascertain the identity of an individual, and this process of ascertaining an individual’s identity does not exceed the bounds of what is reasonable,” Pilgrim said.

“I am consequently of the view that the metadata Telstra holds in connection with an individual which permits that individual’s identity to reasonably be ascertained from that metadata constitutes the personal information of that individual under the Privacy Act.”

The decision was made before the new Australian privacy principles came into force in 2014. But the definition of personal information has not changed significantly, and the decision is likely to carry significant weight in cases under the new privacy regime.