WL v La Trobe University [2005] VCAT 2592

Commentary

  • This decision was based on the preceding legislation to the Privacy and Data Protection Act 2014 (Vic.) (PDP Act), the Information Privacy Act 2000 (Vic.) (IP Act). It provides useful insight into when an individual’s is identity is apparent, whether their identity is reasonably ascertainable, and whether cross-matching information held against third party information is permissible.

Personal information

Whether individual’s identity is ‘apparent’

  • Although not in dispute as both parties agreed that the Complainant’s identity was not apparent, VCAT stated that for an identity to be apparent “one would need to be able to look at the information collected and know or perceive plainly and clearly that it was information about the” individual. They stated that there needs to be some “singular nature” to the information, VCAT giving examples of a name or photograph.

‘Reasonably ascertainable’ – whether extrinsic material can be used to identify a person

  • Although the decision ultimately turned on the various data sets within La Trobe University’s possession, La Trobe University also raised an argument that for a Complainant’s identity to be reasonably ascertainable, it must be solely from the information held and without reference to material held by third parties.
  • La Trobe University highlighted that other legislation, such as the Data Protection Act 1988 (UK) explicitly stated that personal information means information relating to an individual who can be identified from the information or from the information and other information, the omission of such a reference here evidenced Parliament’s intention to exclude cross matching against extrinsic material.
  • VCAT rejected this argument, finding that the use of the word “ascertained” must allow for some resort to extraneous material unless it is to be regarded as mere surplusage. However, VCAT caveated that this must be reasonable and practical in the circumstances. In this case, the cross matching required access to an external database (the White Pages) and even then any connections would not identify the Complainant with certainty, so it was “beyond what is reasonable.”
  • The use of extrinsic material to identify an individual has also been recognised by both the Office of the Victorian Information Commissioner’s (OVIC) IPP Guidelines (at para 1.18) and the Office of the Australian Information Commissioner’s (OAIC) guide on What is personal information (OAIC’s Guide)
  • For example, the OAIC’s Guide provides an example that by itself, contact information such as an address or phone number may not be enough to identify an individual and therefore not be personal information. However, when used to search other databases, this information could be used to identify an individual and become personal information. The OAIC and OVIC highlight that an assessment of fact on a case-by-case basis is required in all instances with similar circumstances to look at the context of information and the likelihood of re-identification.

‘Reasonably ascertainable’ – whether all of the individual’s in the dataset or just the person in questions identity needs to be reasonably ascertainable

  • In this case VCAT appears to have taken the approach that as long as most people in the database could not be identified, then the whole database would not be considered to hold personal information. This is not consistent with the approach taken by OVIC in other similar matters, such as the investigation into the disclosure of myki travel information where OVIC found that because a portion of the dataset was able to be reidentified for specific people, it was deemed to contain personal information.
  • Based on OVIC’s approach, we suggest that the test should be to determine if empirically it is possible to identify any specific person from the dataset rather than the overall likelihood of identifying any random

Facts and decision

  • La Trobe University was carrying out a research study on health and relationships through its contracted service provider Hunter Valley Research Foundation (HVRF).
  • The Complainant’s partner (P) volunteered to participate in the study and provided the Complainant’s contact phone number and address to reach P.
  • HVRF contacted P using the Complainant’s phone number and carried out a survey, during which P answered a number of very personal questions about the Complainant.
  • When the Complainant found out, they raised a privacy complaint. La Trobe University sought to have the application summarily struck or dismissed by VCAT on the basis that they did not hold personal information about the Complainant.

Personal information

Submissions

  • The Complainant contended that their identity was reasonably ascertainable because La Trobe University could cross match the Complainant’s phone number, address, and answers provided by P during the survey to a database they held (which listed the names of owners of phone numbers and addresses) or other modern information systems, such as electronic white pages.
  • La Trobe University contended that the Complainant’s identity was not reasonably ascertainable because phone contact details would not always match those of the owner listed in their database or the White Pages. La Trobe University provided examples of where HVRF contacted a household and the person who answered was renting the premises or visiting the homeowner.

Decision

  • VCAT held that the Complainant’s identity was not reasonably ascertainable from the information and ordered that the application be summarily dismissed. In its decision, VCAT looked at the following factors:
    • the number of personal characteristics of the Complainant in the information to be able to distinguish the Complainant from other individuals was limited to the telephone number, address, and responses by P to questions;
    • the way P had answered the questions did not indicate whether P’s partner (the Complainant) was the home owner;
    • the degree of certainty that the cross matching would likely result in based on a telephone number and address alone was low given that there was no confirmation that the person being contacted on a number was the home owner; and
    • the information was stored across five different databases, with telephone numbers and addresses stored in a separate database to responses received to surveys.

About this decision

Venue: VCAT
Date of decision: 08/12/2005