Commentary
Personal information
- This decision supports the argument that an IP address does not constitute ‘personal information’ and this approach was considered and followed in Ellis v Office of the Victorian Information Commissioner [2024] VCAT 809 (see case note).
- VCAT appears to have been persuaded by the reasoning from the Commonwealth decision Telstra Corporation Limited and Privacy Commissioner [2015] AATA 991 that because an IP address is assigned to a device (or ISP) it is not ‘about’ an individual and therefore not personal information.
- However, it should be noted that the AATA decision went on appeal to the Full Court of the Federal Court and the Full Court did not rule on whether an IP address or other metadata was/was not personal information.
- While neither State nor Commonwealth privacy legislation generally recognises an IP address in isolation, as personal information, there are other laws that designate telecommunications metadata as personal information in specific contexts (e.g., s 187LA of the Telecommunications (Interception and Access) Act 1979 (Cth.)). This decision also recognises that a dataset containing IP addresses amongst other identifying details could, when taken together, be considered personal information, depending on the circumstances.
- It is anticipated that reforms to the Commonwealth Privacy Act will clarify that certain types of metadata are considered personal information. It is also anticipated that the reforms will include an expanded definition of ‘personal information’ in line with the European Union’s approach, whereby information merely must ‘relate to’ an individual, rather than be ‘about’ them. In the interim, the treatment of metadata in relation to privacy laws is an area requiring caution.
Facts and decision
- GMW accessed Victoria Legal Aid’s (VLA) online chat service in order to request that the VLA make some reasonable adjustments to provide a service to him.
- GMW was required to input his age-range, suburb, and email address prior to accessing the chat service.
- During the chat, GMW was temporarily disconnected for three minutes. He then attempted to resume the chat, and the chat was able to re-connect him with the same employee because it recognised the request for reconnection was coming from the same IP address.
- GMW was aggrieved that the VLA collected his IP address because the VLA’s webpage at the time of the chat stated that the VLA did not collect IP addresses. The VLA contended that the IP address was not personal information and so this decision primarily turns upon that aspect.
Allegation
Submissions
- GMW contended that an IP address is personal information as an individual’s identity can be reasonably ascertained from it, demonstrated by the fact that the VLA used it to identify him and reconnect him with the same employee he had been speaking with prior to being disconnected.
- GMW also drew VCAT’s attention to the decision in AC1 and Victoria Police [2019] VICmr 19 where Office of the Victorian Information Commissioner (OVIC) held that an IP address could be personal information within the definition of the Freedom of Information Act 1982 (Vic).
- The VLA contended that an IP address is not personal information as it identifies an ISP or device not an individual user of the device.
- The VLA also drew VCAT’s attention to the decision in Telstra Corporation Limited and Privacy Commissioner [2015] AATA 991 where the Administrative Appeal Tribunal held that an IP address is not personal information as it is allocated to a device so that the device can communicate on the internet.
Decision
- VCAT held that an IP address is not personal information because:
- an IP address is assigned to a device (or ISP) and not the user and is therefore not ‘about’ an individual; and
- although forensic matching and sophisticated algorithms can match a device to an individual, this process does not always make an identity ‘reasonably ascertainable’ given the technology required, and the cost and time involved.
About this decision
Venue: VCAT
Date of decision: 12/08/2022
Tags: