Recent Cases: Victoria
Ellis v Office of the Victorian Information Commissioner (Corrected) (Human Rights) [2024] VCAT 809
Facts
Brad Ellis (“complainant”) alleged that the Office of the Victorian Information Commissioner (“Commissioner”) had breached the Information Privacy Principles and interfered with his privacy. The complainant argued that when accessing the Commissioner’s website he was identifiable through information collected and stored by the Commissioner following its use of Matomo Javascript Tracking Client (“MJTC”).
The personal information he alleged was mishandled included: his IP Address; cookie based identifiers; a Matomo Visitor profile report; general web server logs regarding documents requested and personal information on the complainant’s device and his IP Address. The complainant alleged that the collection occurred when he used the website and when he accessed the e-learning website. He could not object to or decline the use of MJTC, which he alleged was a data surveillance device, and the lack of choice in using MJTC breached IPP 1 in relation to collection and IPP 4.1 in relation to security.
The complaint was referred by the Commissioner to the Victorian Civil and Administrative Tribunal (“Tribunal”) under s 66(4) of the PDP Act.
Personal information
The complainant had accessed the Commissioner’s website through an Internet Service Provider on a business computer, which was solely used by the complainant. The complainant had configured the computer to have a static IP address, which stayed consistent across browsing. The complainant argued that these things meant he was readily identifiable from the information held by the Commissioner.
The complainant had obtained documents in a Freedom of Information request to show record of his usage and the Commissioner’s collection and storage of data by MJTC. The complainant argued that his IP address was his personal information and that he was able to identify his recorded IP address in the records obtained in the FOI Request, meaning he was readily identifiable.
In contrast, the Commissioner argued that the IP address was not information about the complainant, it did not make his identity reasonably apparent, and his identity could not be reasonably ascertained from the personal information.
The evidence addressed the assignation of IP addresses and how the Commissioner handled Internet Service Providers, and its use of MJTC in relation to cookies, device information and the e-learning website. It confirmed that a third party involved in e-Learning did not collect information that could be attributed to an individual. While there was no disclosure to the collection when the complainant used the e-Learning tool, the Commissioner amended its collection statement following the complainant raising concerns through his complaint.
The Tribunal’s decision was that that the complaint failed as the IP address did not identify the complainant. It identified the device owned by, or the ISP licensed to, his business. The activities that were collected by the Commissioner through the cookie-based identifier were activities of a device that was operated by a person, but was not personal information about that person.
The Tribunal held that the purpose and function of the IP address did not change, regardless of whether it was dynamic or static. While the IP address was fixed to the computer used by the complainant, it did not identify him. It accepted that the respondent had no way of knowing the identity of an individual using an IP address until the complainant identified himself. Accordingly, an IP address was not within the definition of personal information in s 3 of the PDP Act.
As the information was not about an individual then it was not necessary for the Tribunal to consider whether a person’s identity was apparent or could reasonably be ascertained from the information for the purpose of the definition of personal information in s 3 of the PDP Act.
Decision
The Tribunal dismissed the complaint after finding that the information was not personal information.