The Definition of Personal Information - Research Paper for the Office of the Australian Information Commissioner - 17 February 2020

Sep 11, 2026

Upload by Stanley

The research paper examines how the Privacy Act’s definition of “personal information” shapes the legal boundaries of what is regulated and protected in Australia. It argues that current definitions lack certainty for technical data and fail to address privacy harms arising from individuation, including tracking, profiling, and targeting without knowing a person’s identity. The paper proposes amending the Act to incorporate a modern definition of “identifiable,” supported by a test covering surveillance, location, contact, targeting, profiling, and linkage to related data, plus clarifying changes to “de-identified.”

LanguageEnglish

CategoryGeneral

FormatPDF

Pages79

Reading Time28 min

AccessFree to download

Why definitions matter

Is the definition fit for purpose?

The Definition of Personal Information Research Paper for the Office of the Australian Information Commissioner 17 February 2020 We know privacy inside out. Executive Summary Data is the lifeblood of the digital economy, and will increasingly power decision-making in all sectors of the economy. Robust data protection regulation is necessary to achieve both consumer protection outcomes, and consistency of the playing field for industry. It will therefore be critical to ensure that the Privacy Act remains fit for its purpose of enabling effective regulation of personal information handling, in line with community and business expectations. Through its Digital Platforms Inquiry, the ACCC found that the current definition of ‘personal information’ suffers from a lack of certainty around its coverage of technical data. The OAIC also raised the issue of whether inferred data is within scope, while a multiplicity of stakeholders expressed concerns that the Privacy Act – and in particular, the definition of‘personal information’ -was not keeping up with the realities of the digital economy. Whether or not any particular piece of data meets the definition of ‘personal information’ is a threshold legal issue for the operation of privacy law in Australia: the definition of ‘personal information’ determines the boundaries of what is regulated, and what is protected. Understanding the scope of what is meant by ‘personal information’ – and ensuring that that definition remains fit for purpose – is therefore a critical endeavour in privacy jurisprudence. The challenges posed to the scope and reach of privacy laws come from many different directions: new technologies, new interpretations arising from case law, the increasing risks of re-identification, exponential growth in computing power, advances in fields like data analytics and cryptography, the phenomenon of data breaches, the influence of global debates, and new directions in statute law internationally. Through the current definition of ‘personal information’, the Privacy Act regulates conduct only when a person is identifiable. However privacy harms can also arise from individuation: the ability to disambiguate or ‘single out’ a person in the crowd, even if that individual’s‘identity’ is not known. This poses a fundamental challenge for current privacy legal frameworks. From the digital breadcrumbs we leave behind in the form of geolocation data shed from our mobile devices, to the patterns of behaviour we exhibit online as we browse, click, comment, shop, share and ‘like’, we can be tracked. Tracked, traced, monitored, surveilled; then profiled; and finally targeted …all without the party doing the tracking, profiling or targeting needing to know ‘who’we are. The digital environment has turned on its head the assumption that identifiability – in the sense of knowing a person’s ‘identity’ - is only vector for privacy harm. Individuation must be anticipated by privacy laws as well. These contemporary challenges lead us to conclude that the definition of ‘personal information’ in the Privacy Act no longer meets the needs of a privacy legal framework suitable for the digital age. The current definitions of ‘personal information’ and ‘de-identified’in the Privacy Act fail to consider the privacy risks posed by individuation, or by attribute disclosure involving third parties. Globally, other jurisdictions have more modern definitions, which clearly anticipate device identifiers , online identifiers and location data being used to identify – or at least ‘single out’ -individuals. Some privacy laws are broadening out the notion of ‘identifiability’ (or even abandoning it altogether) as the threshold element of their definition. So as to enable clarity and consistency in the application of privacy law, and to protect against the potential privacy harms enabled by individuation, this Research Paper concludes that the Privacy Act should be amended, to incorpora

FAQs

Why does the paper focus on the definition of “personal information” in Australia’s Privacy Act?

The definition determines the boundaries of what privacy law regulates and what is protected. It is therefore a threshold legal issue for the operation of privacy law in Australia.

What shortcomings does the paper identify in the current definition for the digital economy?

It states the definition lacks certainty for technical data and does not clearly include inferred data. It also argues that current approaches to “de-identified” fail to consider privacy risks from individuation and attribute disclosure involving third parties.

What amendment does the paper recommend for the concept of “identifiable”?

The paper recommends incorporating a definition under which information is identifiable if it can be identified or discerned as an individual distinct from others, regardless of whether identity can be ascertained or verified. It further suggests a test based on whether an individual or a linked device could be surveilled, tracked, monitored, located, contacted, targeted, profiled, or linked to other data.

Sep 11, 2026

Upload by Stanley