Privacy complaints at OVIC - Guide for respondents

 Download this page as a PDF

 

Key Points

The focus of OVIC’s complaint process is on conciliating complaints about possible breaches of the Information Privacy Principles (IPPs).

It is not OVIC’s role to investigate complaints or decide if your agency has breached the IPPs.

If a complaint is not resolved at OVIC, complainants may take their complaint to the Victorian Civil and Administrative Tribunal (VCAT). The OVIC complaint process provides an opportunity to resolve privacy complaints by agreement.

 

Introduction

When can a privacy complaint be made to OVIC?

Resolving complaints before they escalate to OVIC

What happens when someone brings a complaint to OVIC?

OVIC’s role

OVIC’s complaints process

What is conciliation?

What happens if conciliation is inappropriate?

What happens if conciliation is unsuccessful?

Can the Commissioner decline to entertain a complaint?

What happens if OVIC can’t resolve a complaint?

Referral to the Victorian Civil and Administrative Tribunal (VCAT)

Dismissing a complaint

 

Introduction

Victorian public sector organisations (including Victorian government departments, local councils, statutory offices, government schools, universities and TAFEs) must comply with the Privacy and Data Protection Act 2014(PDP Act).[1]The PDP Act contains ten Information Privacy Principles (IPPs) that govern the collection, management, use and disclosure of personal information, and gives individuals a right to complain if they think that an organisation has breached one of the IPPs.

When an individual believes their privacy has been breached, we advise them to raise the matter with the organisation involved (i.e. you, the respondent) in the first instance. If you are unable to resolve the complaint, that person may bring their complaint to the Office of the Victorian Information Commissioner (OVIC).

At OVIC, our job is to try to resolve complaints by conciliation. That means we don’t take sides, we don’t decide who is right or wrong, and we don’t determine whether an individual’s privacy has or has not been breached. As conciliators, our job is to help your organisation engage with the complainant, talk through the issues and resolve the complaint in a way that is acceptable to everyone, and which upholds the objectives of the PDP Act.

If we cannot resolve a complaint though conciliation, the individual may request for their complaint to be referred to the Victorian Civil and Administrative Tribunal (VCAT).

 

When can a privacy complaint be made to OVIC?

The PDP Act gives individuals a right to complain about breaches of the IPPs. If the complainant has not already done so, OVIC will generally refer them to the Privacy Officer of the respondent organisation to try and resolve the complaint.  This gives organisations an opportunity to resolve complaints quickly and efficiently, before they have a chance to escalate. If the complainant does not receive a response in approximately 30 days, or is not satisfied with the respondent’s response then they are encouraged to bring their complaint to OVIC.

Resolving complaints before they escalate to OVIC

In general, complaints get harder to manage the longer they stay open. This can be because complainants become frustrated with delays, their expectations of a significant outcome increase, or they can start to raise new issues. Conversely, well-handled complaints offer real benefits — each complaint is an opportunity to build or restore public trust and improve services and outcomes for individuals.

Because of this, it is important that organisations have effective internal complaint handling procedures and respond promptly to complaints. The Victorian Ombudsman has produced a Good Practice Guide to Complaint Handling for Victorian Public Sector Agencies,[2]which outlines the guiding principles and practical steps involved in the three key stages of good complaint handling. 

 

What happens when someone brings a complaint to OVIC?

OVIC’s role

OVIC’s main function is to try and help your organisation and the complainant resolve matters through conciliation. Conciliation is a common approach to dispute resolution that is focused on finding ways to resolve disputes, rather than assigning blame or determining fault.

As conciliators, OVIC staff remain independent. We do not take sides, and we do not represent either party. Our job is to help you and the complainant talk through the issues and resolve the complaint in a way that is acceptable to everyone.

OVIC’s complaints process

When we receive a complaint, we conduct an initial reviewto confirm that we have all the information we need and that it’s within our jurisdiction to consider. If a complaint falls outside of our jurisdiction, we’ll usually refer it to the appropriate body. If a complaint is incomplete or unclear, we will usually assist the complainant to refine it. At this stage, we may also contact your organisation to ask questions or to explore options for early resolution of the complaint.

After our initial review, we will formally notify your organisation by sending through a copy of the complaint (or a summary of the complaint if one has been prepared by OVIC staff). If we haven’t already, we’ll ask you to contact us to have a preliminary discussionabout the complaint. We’ll want to hear your initial assessment of the complaint and your views on the outcomes sought, as well as whether you can see any practical options for moving the matter towards resolution.

Depending on the type and seriousness of the complaint, we might ask you for written submissions in relation to the complaint, including whether OVIC should decline to entertain the complaint (see below), or whether conciliation is appropriate in the circumstances (see below). 

If it is appropriate in the circumstances, we will try to conciliate (see below). Conciliation may be conducted indirectly (where the parties communicate with eachother through the OVIC Conciliator), over the phone or at a face to face meeting. The OVIC conciliator will decide on the best approach to conciliation in each case.

In some cases, we might decline to entertain the complaint. For example, if we think that the act or practice complained about does not breach the IPPs, or if we think that the organisation has already dealt adequately with your complaint (see below).

If we think conciliation is inappropriate or has failed, or if we decline to entertain the complaint, we will notify both parties. If this happens, the complainant can have the complaint referred to VCAT (see below).

What is conciliation?

Conciliation is a form of alternative dispute resolution, similar to mediation. Conciliation processes can look quite different in different contexts, but they usually involve an independent person with expert knowledge (the conciliator) helping the parties to identify and agree on a fair resolution of their dispute. The conciliator cannot adjudicate or otherwise determine the outcome of your dispute. However, if required, a conciliator may use their expert knowledge of the legislative context and apply the relevant provisions of the law to challenge positions or raise relevant issues for consideration. That means a conciliator might talk to the parties about the reasonableness of their demands and arguments, or provide an opinion on other matters, such as the prospects of the complaint succeeding at VCAT.

At OVIC, conciliation is voluntary and facilitated by a staff member acting as the conciliator. One of the many advantages of conciliation is that it is significantly less demanding than arguing a case before VCAT. Conciliation is also confidential — any evidence of things said or done in conciliation is not admissible before the tribunal or other legal proceedings, unless you and the organisation agree. You can find out more about conciliation from our separate Conciliation FAQ, which is available on the OVIC website

What happens if conciliation is inappropriate?

While it’s a very effective tool for dispute resolution, not every complaint can be resolved through conciliation. This might be because:

  • the parties views of the facts and/or acceptable options for resolving the matter are so different that it’s unlikely that we can find any common ground,
  • the relationship between the parties has deteriorated so much that talking is unlikely to help, or
  • either party refuses to participate in conciliation (conciliation is voluntary, and relies on consent and collaboration to be effective).

If it doesn’t look like OVIC will be able to resolve a complaint through conciliation, we will close the complaint and the complainant will have an opportunity to have the matter referred to VCAT for hearing (see below).

What happens if conciliation is unsuccessful?

If an agreement cannot be reached through conciliation, the Commissioner will write to the parties to tell them that conciliation has failed. If this happens, we will close the complaint and you will have an opportunity to have the matter referred to VCAT for hearing (see below).

Can the Commissioner decline to entertain a complaint?

Yes. The Commissioner may decline to entertain some complaints, for example, where it doesn’t appear that the act or practice complained about amounts to an interference with privacy, or where the Commissioner considers that the organisation has already responded adequately. The Commissioner may also decline to entertain a complaint if:

  • the complainant didn’t complain to the organisation and give them time to respond before complaining the Commissioner;
  • the matter has been dealt with under another Act, or another Act provides a more appropriate remedy; or
  • the complaint is frivolous, vexatious, misconceived or lacking in substance.

It is important to remember, however, that declining to entertain a complaint may not make it go away. When the Commissioner declines to entertain a complaint, the complainant still has the right to have their matter referred to VCAT. Because of this, it is sometimes productive to try to resolve a complaint through conciliation, even when there may be grounds to decline to entertain it. 

 

What happens if OVIC can’t resolve a complaint?

If we don’t think that we can resolve a complaint, we will write to both parties to explain why. This might be because we decline to entertain the complaint for one of the reasons outlined above, or it might be because we have decided that conciliation is inappropriate or has failed. 

If OVIC can’t resolve a complaint, the complainant may choose:

  • to have the matter referred to VCAT for hearing and determination, or
  • not to pursue the matter further, or to pursue it through some other legal or political mechanism, rather than as a privacy complaint under the PDP Act.

Referral to the Victorian Civil and Administrative Tribunal (VCAT)

Complainants wishing to have their complaint referred to VCAT must notify OVIC in writing within 60 days of receiving notice that OVIC cannot resolve the complaint. The Commissioner has no power to extend the 60 day period. 

Unlike OVIC, VCAT will hear evidence from both parties and can make an enforceable determination about a complaint. If VCAT is satisfied that balance of probabilities, your organisation did interfere with the complainant’s privacy, it can order your organisation to pay compensation or to take certain specified actions. You can find more information about the handling of privacy complaints by VCAT in our Guide to the handling of complaints under the Privacy and Data Protection Act 2014 by the Victorian Civil and Administrative Tribunal.[3]

Dismissing a complaint

If a complaint is not referred to VCAT, it will be dismissed. A complainant may take no further action under the PDP Act in relation to the subject matter of a complaint that is dismissed by the Commissioner. This means that the complainant cannot later make a fresh privacy complaint about the same act or practice (though they may make applications or complaints under other laws). 

 

[1] The PDP Act also applies to some private or community sector organisations who are carrying out functions for or on behalf of a Victorian public sector organisation.

[2] Available at https://www.ombudsman.vic.gov.au/Complaints/Complaint-Handling-Guide.

[3] Available on the OVIC website: https://www.cpdp.vic.gov.au/images/content/pdf/privacy_guidelines/CPDP_Guide_to_the_handling_of_complaints_by_VCAT.pdf

  

Contact

Office of the Commissioner for Privacy and Data Protection
Level 6, 121 Exhibition Street
PO Box 24274
Melbourne Victoria 3001
Telephone: 1300 666 444 (local call)
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Web: www.cpdp.vic.gov.au

 

 

Publication date: June 2018

Please note that the contents of this information sheet are for general information purposes only, and should not be relied upon as legal advice. CPDP does not guarantee or accept legal liability whatsoever arising from, or connected to the accuracy and reliability of the contents of this document. We encourage your organisation to obtain independent legal advice as necessary.