Guide to the handling of complaints under the Privacy and Data Protection Act 2014 by the Victorian Civil and Administrative Tribunal (‘VCAT’)


Download this page as a PDF


The complainant and the respondent to a privacy complaint will be given notice in writing if the Victorian Information Commissioner (‘the Commissioner’) makes a decision that:

  • a complaint should be declined under section 62(1) of the Privacy and Data Protection Act 2014(‘PDPA’);
  • conciliation is not reasonably possible; or
  • conciliation has been attempted, but has failed to result in an agreement.

Upon receiving notice of one of these decisions, a complainant has the right to require the Commissioner to refer his or her complaint to the Victorian Civil and Administrative Tribunal (‘VCAT’) for a determination.

This right must be exercised within 60 days of the complainant receiving notice of the Commissioner’s decision and the complainant must provide the Commissioner with notice in writing that he or she wishes for the matter to be referred to VCAT.


What is VCAT?

VCAT combines a number of tribunals to form one body to hear and decide disputes about a range of issues including information privacy. VCAT is independent of the Office of Victorian Information Commissioner (‘OVIC’). A President who is a Supreme Court judge heads VCAT.

Information privacy complaints are heard in a section of VCAT referred to as the ‘Human Rights List’. A VCAT member who is legally qualified hears privacy complaints.


Who are the parties to a complaint before VCAT?

The complainant and respondent are the parties to the complaint.

Once a complaint has been referred to VCAT, OVIC will have no further direct involvement with the matter. OVIC will not provide any advice to either party in relation to VCAT proceedings.

In limited circumstances, the Commissioner may become an independent party to a proceeding before VCAT. This may occur if VCAT decides to join the Commissioner or if the Commissioner seeks to be joined. The Commissioner will only seek to be a party when the case involves a question of law under PDPA, when the proceeding may have a significant impact upon the interpretation of the PDPA or when it is otherwise in the public interest.

Even in the exceptional circumstances where the Commissioner is a party to proceedings, he will act as an independent and expert participant. As such, the Commissioner may make submissions on questions of law, policy and the public interest as they relate to privacy and the PDPA, but will not advocate for either party.

In the vast majority of cases before VCAT, OVIC will simply monitor proceedings. This will involve OVIC receiving relevant documents from VCAT including copies of Orders and Notices of Hearings. It may also involve OVIC staff attending to observe VCAT hearings.


What is the procedure for hearing complaints in VCAT?

Following a complainant’s written request to the Commissioner for his or her complaint to be referred, the Commissioner will send to VCAT a copy of the original complaint form or written letter of complaint, together with any particulars of the complaint prepared by the Commissioner’s staff.

VCAT will open a case file for the complaint. VCAT will also give notice to the parties of a ‘directions hearing’. This is not the full hearing for the complaint. It is a short hearing at which matters such as what the complaint is about, how many witnesses may be called, and how much time the parties believe they will need to present their arguments, will be discussed.

The member will fix a date and time for the full hearing. Parties may also be asked whether they believe mediation at VCAT may resolve the complaint.

If a party needs to travel from interstate or a rural area, VCAT can arrange for the directions hearing to


What can VCAT do?


Where appropriate, VCAT can arrange mediation for the parties to help resolve privacy concerns. A VCAT member conducts mediation. There is no charge. If mediation fails, the member who conducts the mediation will not hear the complaint.


While hearings at VCAT are less formal than a traditional court setting parties should still expect to:

  • call or give evidence on oath or by affirmation;
  • ask questions of witnesses and be asked questions themselves;
  • present their own arguments; and answer questions put to them by a VCAT member.

It is possible for parties to put their case directly to VCAT themselves without legal representation. After the hearing, VCAT will make a decision. Possible outcomes of the hearing include:

  • dismissal of all or part of the complaint; uphold the complaint but take no further action;
  • order the respondent to stop or not repeat the acts complained of;
  • order the respondent to take some action that will redress any loss or damage suffered
  • by the complainant; and
  • order the respondent to pay the complainant compensation of up to $100,000 for loss
  • or damage suffered by the complainant.

If any party disagrees with the VCAT decision they may appeal questions of law to the Supreme Court of Victoria.


Are there any costs involved?

The general rule is that each party pay their own costs of the proceedings irrespective of the result. However, in some cases, VCAT may make an order that the unsuccessful party pay some or all of the legal costs of the successful party.

All costs and compensation awarded to a party shall be a debt due to that party and recoverable by legal action.


Further information

Victorian Civil and Administrative Tribunal

55 King Street Melbourne VIC 3000

Telephone: 1300 01 8228 (1300 01 VCAT) Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

VCAT’s office hours are 9:00 am – 4:30 pm weekdays


Office of the Victorian Information Commissioner Privacy and Data Protection

GPO Box 24274 Melbourne Victoria 3001

Telephone: 1300 006 842 Email: This email address is being protected from spambots. You need JavaScript enabled to view it.Website:

Publication date: January 2018

Please note that the contents of this information sheet are for general information purposes only, and should not be relied upon as legal advice. OVIC/Privacy and Data Protection does not guarantee or accept legal liability whatsoever arising from, or connected to the accuracy and reliability of the contents of this document. We encourage you or your organisation to obtain independent legal advice as necessary.