“Data” refers to information. A piece of data could be a line of text, an image or a list of figures.
Metadata, therefore, is information about data. Metadata provides an explanation or description of the data, which is useful for finding, using and understanding of the information.
As computer and data specialist Bruce Schneier puts it, “Data is content, and metadata is context.”
For example, if I have an image of a snail in a file of my computer, the image is the data…
…and the information about the image is the metadata:
The metadata provides me with a whole lot of information about the piece of data: where it came from, how large the image is, what colour profile is uses and when I last opened the file.
Why do I need to care about metadata?
“If data is the new oil, then metadata is the refinery; without it, you have no way of knowing or utilizing what you have.” (Adam Rauh, IT specialist)
Metadata is essential for any person (or computer program) that needs to find and organise information. Without metadata, the whole process slows down. Imagine trying to find a book in an enormous library without a catalogue, and without the name and author of the book visible on the cover.
What is personal data?
This one is much easier to understand, because it’s right there in the name: personal data is information about a person, such as you. Your personal data includes your name, address, email, phone number, date of birth etc.
In Australia, “personal information” is defined by whether a person is identified or identifiable from data. This is the definition used in data privacy laws and codes of practice.
Put simply, if data is considered to be “personal information” it is subject to rules under data privacy law…but whether or not something is ruled to be “personal” is an ongoing argument.
Chances are there is a lot of information about you on the internet, but not all of it is clear-cut “personal data”. Think about the information that doesn’t explicitly identify you, such as a list of websites your browser has accessed, your mobile phone’s geolocation, or even your IP address.
And because these pieces of information provide an understanding of your usage habits, they can be described as metadata.
This argument was used in a legal battle in Australia when the Privacy Commissioner determined that URLs, IP addresses and mobile geolocation signals were all metadata. BUT the Commissioner also ruled that some of this metadata could described as personal information, and therefore was subject to privacy laws.
Why? Because by linking many different pieces of your metadata together, an advertiser can develop quite a detailed understanding about what kind of person you are, what your habits are and even what you are likely to do in the future. Read more here.
Oracle Corporation made this argument in its March 2019 submission to the ACCC Digital Platforms Inquiry:
“The collection of some of this data, if looked at in isolation, might be considered innocuous. However, the combination of all of these types of data allows Google to build highly specific super profiles of an individual consumer’s demographic details, behaviours and interests which is then used to sell advertising.”
On this basic, Oracle argued that metadata such as location should be considered personal information, even though it hasn’t been considered as such in the past.
The ACCC admitted that “it is not clear whether the scope of ‘personal information’ under the Privacy Act includes metadata such as IP addresses, other location data, or other technical data,” so it’s likely that this debate will continue in the years to come.
Why data is valuable
Companies can use metadata to deliver targeted advertising online, for example asking Google to only show their ads to people in a specific town or city, or only to users that have looked at certain websites in the last few weeks.
How? Each piece of information about you can be turned into an ad-targeting attribute.
“The more data Google collects on customers, the better it can target ads and the more money it makes.” -Oracle
If a company can see that you’re accessing the internet from Melbourne to look at websites about travelling to China, they can target you with ads for local travel agents or Australian booking sites.
Here is some of my own metadata from Facebook that advertisers can see:
How accurate is this? Well, they’re right, I access Facebook from my mobile phone or on wifi. And yes, I recently changed from one internet provider to another. This means I could sometimes see ads that are targeted at people who have recently changed mobile network.
Now I’m going to look at some real ads that are appearing on my Facebook feed and see why I’m being targeted:
Here’s an ad for a wireless broadband service, and here’s the explanation of what metadata points led me to being targeted:
Here are the metadata points that likely led to this ad targeting me:
But ads can be way, way more targeted. Here’s another ad I saw on Facebook:
Now I’m also being targeted because of past activity on my account. This is also a piece of useful metadata for advertisers.
And according to Oracle, “even race, age, health, religion and financial status may be deduced from the places a person’s smartphone frequents,” so it’s possible that even as simple as your location services are giving tech companies insight into other ad-targeting attributes.
What advertisers see
What does targeted advertising look like from the advertiser’s end?
Here is what you can see when you create an ad in Facebook:
By combining different pieces of metadata, advertisers can make sure their ad is only targeted at relevant audiences, thereby increasing the potential return on investment (ROI).
Regardless of how you feel about the collection and use of metadata, it’s worthwhile understanding the key terms and themes in the discussion around it.
It’s also useful to consider what information is available about you, or your customers, online.