Accessing One's Own Metadata

skegg writes: Frustrated journalist Ben Grubb has documented his attempts at gaining access to his own metadata from his carrier. "After more than a year of phone calls and emails and a private mediation session, it still hasn't released the information or answered my one key question satisfactorily: the government can access my Telstra metadata, so why can't I?" Later, he says, "Telstra's one and only valid argument to date has been that identifying who calls me would be in breach of that person's privacy if they called from an unlisted number. I've agreed and said that in providing me with my metadata they should remove unlisted numbers. They argue this would be too difficult to do, which I think is baloney."

Comments

Baloney?

[Anonymous Coward]

Don't you realize they'd have to re-lubricate the DB2 indexes with heavier oil to fulfill your request? Do you have any idea how hard this is? I just love it when normal people think data like this can be magically retrieved.

Re:Baloney?

[alex67500]

If it can't be retrieved and reworked easily, then it was badly stored and organised in the first place...

Re:Baloney?

[Jane Q. Public]

If it can't be retrieved and reworked easily, then it was badly stored and organised in the first place...

That's not the problem. They DON'T WANT to give people this data. Because once they do, everyone will demand it, and wives will be filing for divorces over it, spawning lawsuits... etc.

Let's put this in perspective: for decades, Ma Bell here in the U.S. denied, even to government, that they had complete records of who called whom, and when for every telephone in the country. In fact this led to the whole thing in TV and movie dramas of "keep them on the line long enough to trace the call". Calls actually haven't needed to be "traced" since the 1960s, but nobody told the government. This led to some huge lawsuits, when an electronics technician accidentally stumbled onto a manual for the machines that were used to compile the phone records.

How many murders, kidnaps, etc. were never solved because the government did not know this information existed?

When asked why they never told anybody, phone company representatives said they didn't want customers to know they had the information to give them itemized bills.

Never underestimate the nefariousness of large corporate execs.

Bull

[gurps_npc]

Now, if they charged him a ridiculous fee for such gathering, that would be another thing.

But their is no way they "can't figure it out"

Re:Bull

[Richard_at_work]

Why should they "figure it out"? They don't owe him this information, it wasn't in any contract he signed to provide it to him, so why should they have to?

Re:Bull

[sumdumass]

Because if they do not offer this metadata as a product at minimum accessible to the people involved, there is a strong case that it is private and the feds or any government organization accessing would absolutely require a warrant according to the constitution.

This is actually about more that trying to see what the government is accessing.

Re:Bull

[Hotawa Hawk-eye]

According to the article, he claims that the law requires them to provide him with the information.

So I asked Telstra to provide me with all of the metadata it had stored about my mobile phone account, informing them that they had a duty to do this under the Privacy Act's National Privacy Principles, which gives Australian citizens a right of access to their "personal information" from a company, and the right to have that information corrected if it is inaccurate, incomplete or out-of-date.

After about a month of back and forth phone calls chasing up a response, Telstra refused me access, saying I needed a subpoena to access the data. A subpoena is a writ usually issued by a court with authority to compel production of evidence under a penalty for failure.

As I didn't have the cash to sue Telstra and get a court to issue a writ, I complained to the federal privacy commissioner, claiming Telstra was in breach of the Privacy Act.

Now it's up to the privacy commissioner to decide who's correct: Telstra or Mr. Grubb.

Re:Bull

[gurps_npc]

RTFA

Why should they figure it out? Because he referenced Australia's Law that said they had to.

Specifically, the Privacy Act's National Privacy Principles law:

http://www.oaic.gov.au/privacy/privacy-act/national-privacy-principles

NPP section 6 says: "Gives individuals a general right of access to their personal information, and the right to have that information corrected if it is inaccurate, incomplete or out-of-date."

Re:Bull

[Anubis IV]

I'm not an Australian, so I may be misunderstanding some of the terminology involved, but it's my understanding that they actually do owe him that information, based on National Privacy Principle 6 (NPP 6) from Australia's Privacy Act of 1988.

Here's a quick summary over the relevant NPP:

Access and correction

NPP 6 requires an organisation to give a person access to personal information that it holds about them, if requested. If a person establishes that the information is not accurate, complete or up-to-date, the organisation must take reasonable steps to correct the information. If the person and the organisation disagree about accuracy, and the person requests it, the organisation is required to include a statement that the individual claims that the information is not accurate, complete or up-to-date.

Organisations may deny an individual’s request for access to information about themselves in a limited range of circumstances. These include if:

• providing access would:
• • pose a serious and imminent threat to the life or health of any person (for health information the threat need not be imminent); or
  • have an unreasonable impact on other individuals’ privacy; or
  • prejudice negotiations between the organisation and the individual; or
  • be unlawful; or
  • prejudice an investigation of possible unlawful activity; or
  • prejudice law enforcement activities; or
  • cause damage to Australia’s security;
• the request for access is frivolous or vexatious;
• the law authorises or requires access to be denied; or
• the information relates to existing or anticipated legal proceedings between the organisation and the individual, and would not be accessible by the process of discovery in such proceedings.

An organisation must provide reasons for denial of access or for a refusal to correct personal information. If an organisation charges for providing personal information, those charges must not be excessive and must not apply to lodging a request for access.

Which is to say, unlike in the US, the data actually may be owed to the customer in this case if the customer makes a request for it. The organization may not provide the information, but they have an obligation to have a very good reason for having done so, else they should have provided the data.

Again, I may be misunderstanding things or unaware of later changes to the law, but I'll share what little I know in the hope that someone more knowledgeable can correct me if I'm off-base.

Re:Bull

[fustakrakich]

It doesn't matter if it's private. The company owns it. They can give it who they want to. And besides, the constitution is a ceremonial document, a showpiece, a facade. The Queen still rules all of Oceania.

Request the government to provide it

[Punko]

If the government already has your meta data, request the government to provide you a copy. At no time should a government have any information about you that you cannot fully review.

Re:Request the government to provide it

[INT_QRK]

The problem with that approach is that information releasable under the Freedom of Information Act (FOIA) does not include information that has been classified. Another kicker? The category of unclassified information administratively designated "For Official Use Only" (FOUO) is also exempt release under FOIA. Even though FOUO is clearly defined, its use is increasing applied with considerable discretion, to the effect that Agencies routinely mark nearly everything FOUO these days. I am neither defending nor condemning these practices, just explaining. "Catch-22 is a beauty, all right!" - Yossarian

Re:Request the government to provide it

[sumdumass]

(US) Interestingly, i was late paying a speeding ticket and failed to appear in court. I was out of town and it completely slipped my mind until i returned home. So i promptly paid the citation and called the police department to see if a warrant for arrest had been issued. The thought was to inform them of the payment so i didn't get stopped and arrested later.

I had to argue with this clerk until she finally had her supervisor step in. She kept saying she couldn't tell me because i might hide. Of course the supervisor started with the premis that i couldn't be beligerant and disrespectful to the clerk. After i told him all i wanted was to know if a warrant had been issued for me. He answered that one was and i would need to carry the reciept with me in case i was stopped before it was revoked.

So sometimes, the people working in government might not even know what the law requires of them. Don't give up on the first try.

Unlisted?

[sgunhouse]

I have to conclude from the supposed difficulty that they store the metadata without noting which numbers are unlisted. Or more correctly, were unlisted at the time, since that status may change.

Re:Unlisted?

[gurps_npc]

They have to fulfill Australia's law. If they failed to store the data in a way that let them satisfy Australia's law, that is THEIR problem, not his.

At the very least, they could call every number on the list and ask the recipient if their number was unlisted. If the number's owner said no, then they could provide it. If the recipient said yes, they could reasonably withhold that number..

Decoding their excuse

[nine-times]

They argue this would be too difficult to do, which I think is baloney.

I think what they probably mean is, it'd be difficult for them to be able to provide this kind of metadata without risking legal/PR trouble. To make sure that they could provide your metadata without revealing information that could possibly open themselves to criminal prosecution or civil suits would require that they pay lawyers to review the whole process. And then they'd need to spend a lot of time internally figuring out whether they want to spin the whole thing for PR purposes, or if seeing your metadata is too scary the be released at all without a PR nightmare.

And that's a bunch of work to satisfy one reporter. Doing that opens to floodgates for them to have everyone request it. So now, they have to review their entire data collection policy and create policies for who can get access to what. That's a lot of work.

I'm not saying they're right to provide access to customer data to the government while denying customers access to their own data. I'm just suggesting that they're probably not lying when they say it's difficult. You just have to know what they mean by "difficult".

The reason

[Charliemopps]

The reason, and I think they should just flat out say it because I think it's valid:

If they allow this guy to get it, then hundreds of thousands of other people will request it as well. They will need to build departments, processes, training, security procedures and create for themselves and very expensive endless quagmire of bureaucracy. Even if he offers to pay for it, someone will eventually sue, somewhere in the world and get it legally defined as a "Right" so then no-one will have to pay. It's Pandoras box, they know it, he knows it, and they are certainly not going to hand him the key.

Corporations are their own worst enemies at times. Just explain this and explain "We don't want to give it to the government either!! But they're making us!" If they're ordered by a court to release the information, they the court has to deal with most of the legal pitfalls. If the wrong information gets into the wrong hands, that's the courts fault. There's no way they are going to volunteer this.

This is Australia

[jeffmflanagan]

They have the data, but there's a spider the size of a pig blocking access to the drive.

Are unlisted numbers protected by law?

[clovis]

"Telstra's one and only valid argument to date has been that identifying who calls me would be in breach of that person's privacy if they called from an unlisted number.

Are anonymous phones calls really protected by law?
I mean is there a law that specifically protects the anonymity of people calling from unlisted numbers?

After all, the person holding the unlisted number placed the call.
Do people coming into your house from the street have a legal expectation of anonymity? Does someone getting into your car have a legal expectation of anonymity?
Why would someone calling your phone have a legal expectation of anonymity?

I suspect it has more to do with corporations that robo-call wanting to hide. It's profitable for the phone companies.
When you become a senior citizen, you will begin to receive endless solicitations for medical alert bracelets, "free product" scams, health insurance and so on. I suppose everyone gets some version of this crap. None of these are allowed under the "Do Not Call" act, but the callers always have unlisted numbers and do not reveal their companies' actual names in the calls.