Accessing One's Own Metadata

skegg writes: Frustrated journalist Ben Grubb has documented his attempts at gaining access to his own metadata from his carrier. "After more than a year of phone calls and emails and a private mediation session, it still hasn't released the information or answered my one key question satisfactorily: the government can access my Telstra metadata, so why can't I?" Later, he says, "Telstra's one and only valid argument to date has been that identifying who calls me would be in breach of that person's privacy if they called from an unlisted number. I've agreed and said that in providing me with my metadata they should remove unlisted numbers. They argue this would be too difficult to do, which I think is baloney."

Comments

Re:Bull

[Hotawa Hawk-eye]

According to the article, he claims that the law requires them to provide him with the information.

So I asked Telstra to provide me with all of the metadata it had stored about my mobile phone account, informing them that they had a duty to do this under the Privacy Act's National Privacy Principles, which gives Australian citizens a right of access to their "personal information" from a company, and the right to have that information corrected if it is inaccurate, incomplete or out-of-date.

After about a month of back and forth phone calls chasing up a response, Telstra refused me access, saying I needed a subpoena to access the data. A subpoena is a writ usually issued by a court with authority to compel production of evidence under a penalty for failure.

As I didn't have the cash to sue Telstra and get a court to issue a writ, I complained to the federal privacy commissioner, claiming Telstra was in breach of the Privacy Act.

Now it's up to the privacy commissioner to decide who's correct: Telstra or Mr. Grubb.

Re:Bull

[gurps_npc]

RTFA

Why should they figure it out? Because he referenced Australia's Law that said they had to.

Specifically, the Privacy Act's National Privacy Principles law:

http://www.oaic.gov.au/privacy/privacy-act/national-privacy-principles

NPP section 6 says: "Gives individuals a general right of access to their personal information, and the right to have that information corrected if it is inaccurate, incomplete or out-of-date."

Re:Bull

[Anubis IV]

I'm not an Australian, so I may be misunderstanding some of the terminology involved, but it's my understanding that they actually do owe him that information, based on National Privacy Principle 6 (NPP 6) from Australia's Privacy Act of 1988.

Here's a quick summary over the relevant NPP:

Access and correction

NPP 6 requires an organisation to give a person access to personal information that it holds about them, if requested. If a person establishes that the information is not accurate, complete or up-to-date, the organisation must take reasonable steps to correct the information. If the person and the organisation disagree about accuracy, and the person requests it, the organisation is required to include a statement that the individual claims that the information is not accurate, complete or up-to-date.

Organisations may deny an individual’s request for access to information about themselves in a limited range of circumstances. These include if:

• providing access would:
• • pose a serious and imminent threat to the life or health of any person (for health information the threat need not be imminent); or
  • have an unreasonable impact on other individuals’ privacy; or
  • prejudice negotiations between the organisation and the individual; or
  • be unlawful; or
  • prejudice an investigation of possible unlawful activity; or
  • prejudice law enforcement activities; or
  • cause damage to Australia’s security;
• the request for access is frivolous or vexatious;
• the law authorises or requires access to be denied; or
• the information relates to existing or anticipated legal proceedings between the organisation and the individual, and would not be accessible by the process of discovery in such proceedings.

An organisation must provide reasons for denial of access or for a refusal to correct personal information. If an organisation charges for providing personal information, those charges must not be excessive and must not apply to lodging a request for access.

Which is to say, unlike in the US, the data actually may be owed to the customer in this case if the customer makes a request for it. The organization may not provide the information, but they have an obligation to have a very good reason for having done so, else they should have provided the data.

Again, I may be misunderstanding things or unaware of later changes to the law, but I'll share what little I know in the hope that someone more knowledgeable can correct me if I'm off-base.

Re:Request the government to provide it

[sumdumass]

(US) Interestingly, i was late paying a speeding ticket and failed to appear in court. I was out of town and it completely slipped my mind until i returned home. So i promptly paid the citation and called the police department to see if a warrant for arrest had been issued. The thought was to inform them of the payment so i didn't get stopped and arrested later.

I had to argue with this clerk until she finally had her supervisor step in. She kept saying she couldn't tell me because i might hide. Of course the supervisor started with the premis that i couldn't be beligerant and disrespectful to the clerk. After i told him all i wanted was to know if a warrant had been issued for me. He answered that one was and i would need to carry the reciept with me in case i was stopped before it was revoked.

So sometimes, the people working in government might not even know what the law requires of them. Don't give up on the first try.