Personal information is information or an opinion, including information or an opinion forming part of a database, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
The concept of personal information is central to the Information Privacy Act 2009 (Qld) (IP Act). The objects of the IP Act are:
Personal information is defined in section 12 of the IP Act, and is used in both the IP Act and the Right to Information Act 2009 (Qld) (RTI Act).
Under the IP Act:
Under the RTI Act:
Personal information can be almost any information that is associated with an identifiable living individual. It can include correspondence, audio recordings, images, alpha-numerical identifiers and combinations of these.3
For information to be personal information two criteria must be satisfied.4
Information does not have to be true in order to be personal information and it does not need to be written down or recorded in another material form, such as a photograph or audio recording. It can be spoken or communicated in another way, for example, by sign language.
Where information is not clearly about an individual, eg name, date of birth etc, it will be necessary to consider the context in which the information appears. The key question to ask is, taking into account all the circumstances in which the information appears, is there sufficient connection between the fact or opinion and the individual to reveal something about the individual?
Some information will obviously be about an individual: medical records, financial records, bank details or salary. For other information, the connection between the individual and the information will not be so obvious. Even if the information appears to be about something other than an individual—a car, for example, or a piece of land—it can still be about the individual. For example, information that the rates account for a particular property has not been paid for a year is about the land, but it also reveals a fact about the owner, that they have not paid the rates account they owe their local council.5
The OIC's What is Personal Information checklist will help determine if information is about an individual.
In Tomkins and Rockhampton Regional Council6 the Assistant Information Commissioner considered whether “line up” photographs of dogs and interview recordings with a person attacked by specific dogs were about the individual dog owner. The recordings were about the victim’s account of the attack and her consideration of the dog “line up” photos. There was no information on the photographs that related to the dog owner, only handwritten numbers.
The Commissioner decided neither the recordings nor the photographs were about the dog owner: neither revealed a fact or opinion about the dog owner nor was there a sufficient link or connection between the information in the recording or photographs and the dog owner.7
An individual's identity will be apparent where it can be determined from the information itself, without referring to any other information. For example:
'Reasonably ascertainable' allows for the information to be compared or cross-referenced with other information to identify the person. How far the cross-referencing can go and still be reasonable will depend on a number of factors, such as:
The definition of personal information is very broad and it captures a large amount of information. Examples of personal information are:
Personal information includes some information that people may not normally consider to be private. For example:
However, this does not necessarily mean that the routine personal work information of public servants is not appropriate to be released. See the Guideline: Routine personal work information of public sector employees for more information on this issue.
The Office of the Information Commissioner's website contains guidelines on the IP Act.
Current as at: March 4, 2016