personal information (within the meaning of the Privacy Act 1988) that relates to at least 20,000 individuals; or