Guide for complainants under the Privacy and Data Protection Act 2014

 Download this page as a PDF

 

Complaints can be resolved at an early stage with the help of an officer from the Office of the Commissioner for Privacy and Data Protection. The officer may talk to you about the possibility of early resolution before any investigation takes place, discuss options with both you and the respondent, and try to negotiate an outcome suitable to both parties. This option is quicker and less onerous on both parties. A discussion about early resolution does not mean that the Commissioner for Privacy and Data Protection (Commissioner) has formed any view about your complaint. If it does not resolve he may still decline to entertain it after investigation (see below).

It is important to remember that even if the parties try to resolve the complaint early, and this is unsuccessful, your complaint will still proceed through the Office of the Commissioner for Privacy and Data Protection’s normal complaint handling procedures.

 

The Privacy and Data Protection Act 2014 (the Act) gives you the right to complain to the Commissioner about a breach of your privacy. Your complaint must be in writing. It can be in a language other than English. If you need help writing your complaint, you can ask an officer from the Office of the Commissioner for Privacy and Data Protection to help you. Contact details are at the end of this Guide.
There are some limits on your right to complain. These are:

  • • Complaints can only be made against state public sector organisations, local councils, statutory bodies, State Ministers and Parliamentary Secretaries and in some circumstances organisations providing services for the State
  • • Complaints can only be made about a breach of one or more of the 10 Information Privacy Principles
  • • Complaints should be made within 45 days of you finding out about the breach. However, if there is a reason why you could not complain within 45 days, the Commissioner may allow you to continue with your complaint
  • • Complaints can only be about personal information that is recorded in some form
  • • Complaints cannot be made about a breach of privacy that occurred before 1 September 2002, unless it is continuing
Who can complain?

The general rule is that you can only complain about an act that is a breach of your own privacy. However there are some circumstances in which you can complain on behalf of someone else. These are:

  • • You are one of a group of people who are affected by the breach, and the other people consent to you complaining on their behalf as well as your own
  • • You are the parent of a child whose privacy has been breached
  • • You are a person chosen by a child whose privacy has been breached
  • • You are a person complaining on behalf of a child and are a person who the Commissioner is satisfied has sufficient interest in the complaint
  • • You have been authorised by a person with a disability who cannot make a complaint because of that disability
  • • You are complaining on behalf of an individual with a disability who is unable to authorise you and you are a person who the Commissioner is satisfied has a sufficient interest in the complaint
Do I need a lawyer?

No – the Commissioner does not make any binding determination. The Office of the Commissioner for Privacy and Data Protection assists parties to resolve complaints. Staff from the Office of the Commissioner for Privacy and Data Protection do not act for either party. However, if you want to seek legal advice you can do so at any time.

What happens when the Office of the Commissioner for Privacy and Data Protection receives your complaint?

The Commissioner will decide from the information you provide in your complaint whether it is a matter that he has the power to investigate. If it is not, you will be told.

You may be asked for some more information to help the Commissioner decide if he can investigate.

If you have made a complaint that could be made to the Federal Privacy Commissioner, the Health Services Commissioner or the Ombudsman, the Commissioner may refer your complaint to the appropriate body. You and the organisation against which you are complaining will be told of the referral.

What happens when the Commissioner has the power to investigate your complaint?

A staff member of Office of the Commissioner for Privacy and Data Protection will be assigned to handle your complaint. The Commissioner has made no decision about the merits of your claims. The officer dealing with your complaint must act impartially. He or she will assist you to resolve your complaint, but is not your advocate.

The organisation you have complained about (the respondent) will be told the details of your complaint in writing. The Act requires the Commissioner to do this as soon as practicable after receiving your complaint.

The respondent will be asked to respond to your complaint. Depending on what the respondent says, you and/or the respondent may be asked to provide more information. You may be invited to come to the Office of the Commissioner for Privacy and Data Protection to discuss the matter.

Can the Commissioner decide not to investigate a complaint?

The Commissioner may decide not to continue his investigation. He must make that decision within 90 days of deciding that your complaint can be investigated. The Act sets out reasons that the Commissioner can decline your complaint. These include:

  • • There has not been an interference with your privacy
  • • You have not complained to the respondent before complaining to the Commissioner
  • • You have complained to the respondent and the respondent has either dealt with the complaint adequately or has not had adequate opportunity to deal with it
  • • You have not complained within 45 days of becoming aware that a breach of your privacy had occurred
  • • Your complaint has been dealt with under another Act, or another Act provides you with a more appropriate remedy
  • • Your complaint is frivolous, vexatious, misconceived or lacking in substance
  • • You have made a complaint on behalf of a child or person with a disability and you do not have sufficient interest in the complaint
What can be done to resolve your complaint?

The Commissioner is not a judge with power to decide and make a binding ruling about your complaint. He cannot order the respondent to compensate you.

The Commissioner must try and help you and the respondent resolve your complaint if possible. The Act calls this conciliation. Conciliation is intended to help the parties to reconcile their differences themselves.

There is no restriction on when attempts can be made to resolve a complaint, except the Commissioner cannot do so if he has declined your complaint. You and the respondent will be encouraged to try and resolve the complaint at an early stage.

What happens if your complaint cannot be resolved through conciliation?

The Commissioner may decide that conciliation is not appropriate. This might be because:

  • • You or the respondent refuse to try and resolve the complaint
  • • The subject matter of your complaint is such that the Commissioner does not believe conciliation is possible

If there have been attempts to resolve your complaints and these have failed, the Commissioner may decide that your complaint cannot be resolved by conciliation.

What happens if you don’t respond to requests from the Office of the Commissioner for Privacy and Data Protection

You may be asked to provide information about your complaint, or respond to a proposal by the respondent to resolve your complaint or to contact the office for some other reason relating to your complaint.

If you fail to respond to a request from the office within 90 days, the Commissioner may decide your complaint is stale and dismiss your complaint. You will be notified if your complaint is dismissed as “stale”.

If your complaint is dismissed because you have failed to respond you cannot take any further action about your complaint. It is important that you keep in contact with the officer handling your complaint. If your contact details change be sure to inform him or her.

What happens if the Commissioner has declined your complaint, or has decided that conciliation is not possible or has failed?

In each case you and the respondent will be notified in writing of the Commissioner’s decision and the reasons for it.

When you receive notification of the Commissioner’s decision you have the right to ask the Commissioner to refer your complaint to the Victorian Civil and Administrative Tribunal (VCAT) for determination. VCAT can hear evidence on oath and make an enforceable determination about your complaint. VCAT can order the respondent to take certain action to remedy the complaint. You are encouraged to discuss the matter with the officer who has been dealing with your complaint before deciding whether you want it referred to VCAT.

If you decide you want your complaint referred to VCAT you must tell Office of the Commissioner for Privacy and Data Protection in writing within 60 days of receiving the Commissioner’s decision. The Commissioner has no power to extend the 60 day period. If you fail to notify the office in time you will lose your right to have the complaint heard by VCAT.
If you decide you do not want to have your complaint heard by VCAT the Commissioner may dismiss your complaint after the 60 days. You and the respondent will be notified that your complaint has been dismissed. You cannot take any further action about the complaint once it has been dismissed.

Contact

Office of the Commissioner for Privacy and Data Protection
Level 6, 121 Exhibition Street
PO Box 24014
Melbourne Victoria 3001
Telephone: 1300 666 444 (local call)
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Web: www.cpdp.vic.gov.au

 

 

Publication date: Feb 2016

Please note that the contents of this information sheet are for general information purposes only, and should not be relied upon as legal advice. CPDP does not guarantee or accept legal liability whatsoever arising from, or connected to the accuracy and reliability of the contents of this document. We encourage your organisation to obtain independent legal advice as necessary.