Conciliation at the Office of the Commissioner for Privacy and Data Protection – for Respondents

Download this page as PDF

What is Conciliation?

Conciliation is an alternative dispute resolution (ADR) process to assist parties resolve disputes without resorting to court action. A neutral third party (the Conciliator – a staff member of the Office of the Commissioner for Privacy and Data Protection) helps the parties in discussing their issues and assists them to come up with options to resolve the dispute.

Why has the complaint been referred to conciliation?

The Commissioner for Privacy and Data Protection has not determined a breach of the Privacy and Data Protection Act 2014 (‘the Act’) and does not have powers to do so.

However, the Commissioner has decided not to decline the complaint and thinks there is a possibility the complaint can be resolved via a conciliation process.

The Commissioner’s letter will generally explain in more detail why the complaint is being referred to conciliation.

Is conciliation a court or tribunal?

No – conciliation is not a fact-finding mission and is not about deciding right or wrong or determining legal arguments. The goal of conciliation is to try and resolve complaints, and parties don’t need to agree on every fact or issue in order to resolve a complaint.

Does the organisation have to participate in conciliation?

The Commissioner expects organisations to participate fully and effectively in conciliation processes in line with the Victorian Government Model Litigant Guidelines. [1]

Conciliation is also an opportunity for an organisation to resolve a dispute at an early stage and without involving litigation at VCAT.

The Commissioner does have powers under the Act to require a person to attend conciliation and to produce documents by written notice.

However, if the organisation has a reason why they consider conciliation may be inappropriate or unhelpful, they need to discuss this with the Conciliator assigned to the complaint at the earliest possible stage.

Conciliation inappropriate

If the Privacy and Data Protection Commissioner does not consider it reasonably possible that a complaint may be conciliated successfully, the Commissioner may declare that conciliation is inappropriate. If this occurs, conciliation will not proceed.
The Commissioner may do this, for example, when:

  • • Parties indicate a refusal to participate in the process
  • • The relationship between two parties is so poor that it makes resolution not reasonably possible
  • • Any party displays unacceptable and/or threatening behavior, or
  • • Any other information or reason that leads the Commissioner to consider resolution is not reasonably possible.

If the Commissioner declares that conciliation is inappropriate, both parties will be notified. A Complainant will still have a right to refer their complaint to the Victorian Civil and Administrative Tribunal (VCAT).

What does the Conciliator do?

An impartial Conciliator (an Office of the Commissioner for Privacy and Data Protection staff member trained in alternative dispute resolution processes) organises and chairs a discussion between the two parties to help each party put its point of view forward and come up with ways to resolve the dispute.

The Conciliator is impartial and independent, and cannot force either party to accept outcomes. However, the Conciliator can make suggestions on how to resolve the complaint.

The Conciliator can discuss how the Privacy and Data Protection Act works, how the Commissioner may interpret the Act and how the Victorian Civil and Administrative Tribunal (VCAT) could interpret the matter based on previous complaints.

What things can’t a Conciliator do?

The Conciliator cannot:

  • • Make a complainant or organisation do something (or agree to something)
  • • Provide legal advice to either party, or
  • • Tell you whether you should or should not accept offers, or recommend any outcome to the dispute.
What types of conciliation are there?

The Conciliator can conduct the conciliation process in two ways:

  • • Indirect – where negotiation occurs through the Conciliator.
  • • Direct – the two parties meet (either in person or by telephone) together with the Conciliator to try and resolve the complaint.

The Conciliator will decide on the best way to conduct the conciliation process.

What happens during a conciliation meeting?

Usually, the Conciliator will explain the ground rules to each party. A ‘joint session’ then occurs where both parties are given a chance to put their side of the complaint forward and discuss the matter in a respectful manner.

After this, the Conciliator will talk with the organisation and the complainant separately in ‘private sessions’ to discuss ways to resolve the complaint.

The Conciliator may then conduct a shuttle negotiation between both parties, or can brings both parties back together again in another joint session so that the parties can discuss ways of resolving the complaint directly.

Conciliation meetings are usually about three hours in length.

Are conciliations confidential?

Yes. Section 70 of the Act states that evidence of things said or done in conciliation are not admissible before the tribunal or other legal proceedings, unless the parties agree. This means you can talk openly about the complaint in conciliation without being worried that what you say can be used later (e.g. at VCAT). This extends to discussions, letters, telephone calls or things said and done in a meeting.

Also, conversations you have with the Conciliator directly are confidential. The Conciliator will only disclose information to the other party with your permission.

The Conciliator may take notes in the meeting, but the notes are simply for recording the discussion and outcome of the meeting and for the Conciliator to prepare a written agreement (if successful). Once conciliation is finalised, the notes are immediately destroyed by the Conciliator and are not accessible.

Also, if an agreement is reached, the parties can decide whether they want to make the agreement reached confidential.

Finally, the Commissioner urges both parties to keep matters discussed in conciliation confidential and to avoid discussing what happened during a conciliation meeting outside of the process.

What is the benefit of reaching an agreement?

If an agreement is reached, it means that the complaint ends and the matter cannot be pursued further at VCAT.

What should the organisation talk about?

Conciliation provides an organisation with an opportunity to put their view forward and explain what the organisation thinks has occurred from their end.

It may be important to communicate the way the organisation has handled personal information to the Complainant.

Who should attend from an organisation?

It is important that an organisation’s representative:

  • • Understands the factual issues involved and can talk about them;
  • • Has authority to make decisions on behalf of the organisation to settle the matter; and
  • • Was not closely involved with the subject matter of the complaint (for example, the employee alleged to have caused a privacy breach).
Can we bring a lawyer?

Legal representation is not necessary. An organisation proposing to bring legal representation must discuss this with the Conciliator at the earliest possible opportunity.

Model Litigant Obligations

Australian governments have a common law responsibility to act as a model litigant.

In particular, Victorian Government organisations are bound to comply with the Victorian Model Litigant Guidelines (revised 2011). This requires organisations, amongst other things, to ‘participate fully and effectively’ in Alternative Dispute Resolution negotiations and seek to resolve disputes by agreement. The Commissioner for Privacy and Data Protection expects organisations to know, understand and act in accordance with their model litigant obligations. Please contact the Conciliator for a copy of the Guidelines or if you wish to discuss them.

What should I do before a conciliation meeting?

You may want to:

  • • Think about what the organisation wants to communicate to the Complainant (e.g. the organisation’s view of what happened, and to address any concerns the complainant may have); and
  • • Start thinking about possible options that the organisation could do to resolve the complaint, and get necessary approval/authority before conciliation.
Common outcomes sought in conciliation

Each complaint is different, and every outcome is dependent on both parties being willing to agree on a way to resolve the complaint.

However, commonly sought outcomes include:

  • • An explanation of what occurred
  • • An apology
  • • A change of procedures or processes which created the issue
  • • Education of staff on privacy issues
  • • Action remedying loss/damage suffered, and
  • • Compensation for loss/damage suffered (including injury to feelings or humiliation suffered) as a result of the alleged privacy breach.
Statistical Outcomes

As at June 30 2011, conciliated complaints have involved the following outcomes:

(Note: Complaints are often resolved with more than one outcome, and the outcomes below refer only to successfully conciliated complaints – not matters deemed inappropriate for conciliation, where conciliation has failed or where the Commissioner has declined to entertain the complaint.)

  • • 50% involved payment of compensation
  • • 43% involved provision of an apology
  • • 35% involved changes or reviews of procedures/ practices of organisation
  • • 14% involved training or education for organisational employees, and
  • • 22% involved some ‘other’ action by organisation (e.g. removing material from a website, an explanation, amending a document or other remedial action).
What if there is no agreement on the day?

If the Conciliator believes that it is possible the parties may reach agreement, he or she can adjourn the conciliation to continue the process through the Conciliator (indirectly), or have another meeting.

Alternatively, if the Conciliator considers that the process is unlikely to resolve the complaint, the Conciliator speaks to the Commissioner to have the process declared as ‘failed’.

What happens when an agreement is reached?

If the parties reach agreement, either party can request it be put in writing (within 30 days after agreement). This will generally be prepared by the Conciliator and sent to both parties for signature. The Commissioner certifies the agreement and provides a certified copy to each party. Any party can seek to have the agreement registered at VCAT. If registered, the agreement becomes an order of VCAT.

What happens if an agreement cannot be reached?

If the parties cannot reach an agreement through conciliation, the Commissioner will notify both parties in writing that conciliation has failed.

A complainant has 60 days from receiving that notice to request referral (in writing) of the complaint to the VCAT for hearing.


If you have any questions about the conciliation process, please contact the Conciliator assigned to your complaint. Their contact details will be on the letter from the Commissioner for Privacy and Data Protection referring the complaint to conciliation.


Office of the Commissioner for Privacy and Data Protection

PO Box 24274

Melbourne VIC 3001

Telephone: 1300 666 444 (local call)

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.





[1] Department of Justice, Victorian Model Litigant Guidelines, March 2011, available at


Publication date: Feb 2016


Please note that the contents of this information sheet are for general information purposes only, and should not be relied upon as legal advice. CPDP does not guarantee or accept legal liability whatsoever arising from, or connected to the accuracy and reliability of the contents of this document. We encourage your organisation to obtain independent legal advice as necessary.