Section 12 of the Information Privacy Act 2009
Personal information
Personal information is information or an opinion, including information or an opinion forming part of a database, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
The concept of personal information is central to the Information Privacy Act 2009 (Qld) (IP Act). The objects of the IP Act are:
- the fair collection and handling of personal information in the public sector environment
- to provide a statutory right for individuals to access and amend their personal information held by entities in the public sector environment.1
Personal information is defined in section 12 of the IP Act, and is used in both the IP Act and the Right to Information Act 2009 (Qld) (RTI Act).
Under the IP Act:
- personal information held by Queensland public sector agencies2 is protected by the privacy principles in schedules three and four of the IP Act
- there are limits placed on when personal information can be sent out of Australia
- individuals can apply to access their personal information without having to pay a fee
- individuals can apply to have their personal information amended if they believe it is inaccurate, incomplete, out-of-date or misleading without having to pay a fee.
Under the RTI Act:
- individuals can apply to access information, including the personal information of other people, but a fee is payable
- personal information is one of the factors to be considered when deciding if release of information might be contrary to the public interest
- it is an offence to attempt to mislead or deceive a person in order to gain access to someone else's personal information
- agencies are not permitted to publish personal information of an applicant in their disclosure logs.
What is personal information?
Personal information can be almost any information that is associated with an identifiable living individual. It can include correspondence, audio recordings, images, alpha-numerical identifiers and combinations of these.3
For information to be personal information two criteria must be satisfied.4
- It must be about an individual.
- The individual's identity must be reasonably ascertainable from the information or opinion.
Information does not have to be true in order to be personal information and it does not need to be written down or recorded in another material form, such as a photograph or audio recording. It can be spoken or communicated in another way, for example, by sign language.
When will information be 'about' an individual?
Where information is not clearly about an individual, eg name, date of birth etc, it will be necessary to consider the context in which the information appears. The key question to ask is, taking into account all the circ*mstances in which the information appears, is there sufficient connection between the fact or opinion and the individual to reveal something about the individual?
Some information will obviously be about an individual: medical records, financial records, bank details or salary. For other information, the connection between the individual and the information will not be so obvious. Even if the information appears to be about something other than an individual—a car, for example, or a piece of land—it can still be about the individual. For example, information that the rates account for a particular property has not been paid for a year is about the land, but it also reveals a fact about the owner, that they have not paid the rates account they owe their local council.5
The OIC's What is Personal Information checklist will help determine if information is about an individual.
In Tomkins and Rockhampton Regional Council6 the Assistant Information Commissioner considered whether “line up” photographs of dogs and interview recordings with a person attacked by specific dogs were about the individual dog owner. The recordings were about the victim’s account of the attack and her consideration of the dog “line up” photos.There was no information on the photographs that related to the dog owner, only handwritten numbers.
The Commissioner decided neither the recordings nor the photographs were about the dog owner: neither revealed a fact or opinion about the dog owner nor was there a sufficient link or connection between the information in the recording or photographs and the dog owner.7
When will an individual's identity be apparent or reasonably ascertainable?
An individual's identity will be apparent where it can be determined from the information itself, without referring to any other information. For example:
- where the information includes the person's name
- where the information includes the person's photograph, where they can be clearly seen in the photograph; or
- where the information is so unique that it cannot be anyone else, for example, if the information says it is about 'the woman who wears a crown and was Queen of England in 2008'.
'Reasonably ascertainable' allows for the information to be compared or cross-referenced with other information to identify the person. How far the cross-referencing can go and still be reasonable will depend on a number of factors, such as:
- How available is the other information?
- How difficult is it to obtain?
- How many steps are required to identify the person?
- How certain will the identification be? Will it identify one specific person or a group of people?
- Can the person receiving the information use it to identify the person? For example, if the information is a fingerprint, the average person will not have access to a database which will enable them to match it to a person, while a police officer may have access to such a database.
Examples of personal information
The definition of personal information is very broad and it captures a large amount of information. Examples of personal information are:
- a person's name, address, phone number or email address
- a photograph of a person
- a video recording of a person, whether CCTV or otherwise, for example, a recording of events in a classroom, at a train station, or at a family barbecue
- a person's salary, bank account or financial details
- allegations of wrongdoing against a person or details of wrongdoing or offences they may have committed
- details about a person's land ownership or disputes to do with their land
- details about a person's education or education activities, such as what degree they possess or their candidature for a PhD
- the fact that a person is a member, or leader, of an association and their attendance at meetings
- a person's medical details or health information
- a person's fingerprints or blood type
- details about a person's religious or sexual preferences
- details about a person's membership of a trade union or professional body.
Personal information includes some information that people may not normally consider to be private. For example:
- a work email address or phone number
- opinions given as part of a person's employment
- the fact that a person is the author of a report
- a person's name appearing in work documents
- a letter written in a person's official capacity, such as a letter from the president of a club.
However, this does not necessarily mean that the routine personal work information of public servants is not appropriate to be released. See the Guideline: Routine personal work information of public sector employees for more information on this issue.
Further reading
The Office of the Information Commissioner's website contains guidelines on the IP Act.
- 1 Section 3 of the IP Act.
- 2 In this Guideline references to an 'agency' include Ministers, unless otherwise specified.
- 3 Office of the Victorian Privacy Commissioner, Guidelines to the Information Privacy Principles, September 2006.
- 4 Mahoney and Ipswich City Council (Unreported, Queensland Information Commissioner, 17 June 2011).
- 5 As details of property ownership is a matter of public record, and titles can be searched for and viewed by anyone for a small fee, the identity of a property owner will always be reasonably ascertainable.
- 6 [2016] QICmr 2 (22 January 2016) (Tomkins), applying Mahoney. 'About' is also discussed in Telstra Corporation Limited and Privacy Commissioner [2015] AATA 991
- 7 Tomkins at paragraph 32.
