PRIVACY COMPLAINT FORM

For complaints relating to a Victorian Government organisation, contracted service provider, or a local Council

The Office of the Victorian Information Commissioner (OVIC) can only deal with complaints regarding the handling of personal information by Victorian Government organisations (other than health care organisations), contracted service providers, or a local Council.

A definition of personal information and a list of the ten Information Privacy Principles (Principles) is set out in the accompanying pages. You can make a complaint if you think the organisation you have named has compromised one or more of these Principles.

If your complaint concerns a private sector organisation, an Australian Government organisation or a Victorian health care provider you should not complete this form and instead direct your complaint as follows:

Private sector organisation Contact the Office of the Australian Information Commissioner on 1300 363 992 and do not complete this form
Australian Government organisation Contact the Office of the Australian Information Commissioner on 1300 363 992 and do not complete this form
Victorian health care provider such as a public hospital or a community health service, or a private health provider Contact the Victorian Health Services Commissioner on 1300 582 113 and do not complete this form

If you are unsure as to whether the organisation about which you want to complain is regulated by this Office, please contact us during business hours on 1300 666 444 (local call charges apply) to discuss.

Handling of your complaint

Treatment

Before our Office will accept a complaint, we must be satisfied that the matter meets the complaint criteria as set out in the Privacy and Data Protection Act 2014 (PDPA). Until such time as our Office has made an assessment of the matter and is satisfied that the complaint criteria have been met, the matter will be treated as an enquiry.

Collection, use and disclosure of your personal information

In the course of submitting this form, you are providing personal information. Your personal information will be managed in accordance with the OVIC,Privacy and Data Protection Privacy Policy, available at https://www.cpdp.vic.gov.au.

  • You may gain access to a copy of your personal information by making a Freedom of Information (FOI) request to our Office. You may contact our Office for assistance with this request.

  • • Our Office collects your personal information for the purposes of assisting you to make a privacy complaint. In the course of your complaint, we may also collect personal information about you from the responding organisation.

  • • We may disclose your personal information (with your consent) to the organisation you wish to complain about. This is to enable the organisation an opportunity to investigate your complaint and provide a response to our Office. If you subsequently request us to refer your complaint to the Victorian Civil and Administrative Tribunal, we will be required to disclose your personal information and the particulars of your complaint.

  • • The PDPA states that an organisation may collect personal information if it is necessary to fulfill the organisation’s functions. One of our functions under the PDPA is to assist an individual to make a privacy complaint. To facilitate this, our Office requires disclosure of your personal information to OVIC to facilitate a meaningful response from the organisation.

  • • You are welcome to contact our Office anonymously to make an enquiry or discuss privacy issues. However if you do not wish to provide your personal information, our Office may be limited in the assistance we can provide you, and will not be able to handle your matter as a complaint.

  • • If you need help completing this form, or wish to obtain further information about this process, please telephone our Office. You may also access “Guide to Complainants” and “Guide to Conciliation” on our web site at https://www.cpdp.vic.gov.au for further information.

  • • You may complete this form in a language other than English.

What is personal information?

“Personal information” means information or an opinion (including information or an opinion forming part of a database), that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, but does not include information of a kind to which the Health Records Act 2001 applies.

Information Privacy Principles

With limited exemptions, all Victorian Government organisations, contracted service providers and local Councils must comply with these Principles. This is a short summary of the Information Privacy Principles: 1

1 Collection

An organisation can only collect your personal information if it is necessary to fulfill its functions. It must collect information only by lawful and fair means and not in an unreasonably intrusive way. It must provide you notice of the collection, including such things as the purpose of collection and how you can access the information. This is usually done through provision of a Collection Notice that is consistent with an organisation’s Privacy Policy. More information on these two documents is available on www.cpdp.vic.gov.au.

2 Use and Disclosure

Your personal information can only be used and disclosed for the primary purpose for which it was collected, for a secondary purpose that you would reasonably expect or in other limited circumstances. It is best that the organisation gets your consent, but the law allows some uses without consent, such as law enforcement purposes and to protect safety.

3 Data Quality

Organisations must keep your personal information accurate, complete and up to date.

4 Data Security

Your personal information must be protected from misuse, loss, unauthorised access, modification or disclosure. An organisation must take reasonable steps to destroy or permanently de-­‚Äźidentify your personal information when it is no longer needed.

5 Openness

Organisations must have clearly expressed policies on the way they manage personal information. You can ask to view an organisation‘s Privacy Policy.

6 Access and Correction

You have a right to seek access to your own personal information and to make corrections if necessary. An organisation may only refuse in limited circumstances that are detailed in the PDPA, for example where disclosure might threaten someone’s safety.

7 Unique Identifiers

Unique identifiers, usually a number, can facilitate data matching. Use of unique identifiers is only allowed where an organisation can demonstrate that the assignment is necessary to carry out its functions efficiently. There are also restrictions that are detailed in the PDPA on how organisations use unique identifiers assigned by other organisations.

8 Anonymity

Where lawful and feasible, you should have the option of transacting with an organisation without identifying yourself.

9 Transborder Data Flows

If your personal information travels outside Victoria, your privacy protection should travel with it.

10 Sensitive Information

This includes your racial or ethnic origin, political opinions and membership of political associations, religious or philosophical beliefs, membership of professional or trade associations or trade unions, sexual preferences or practices, and criminal record. The law puts special restrictions on its collection.

Note – before our Office can consider a complaint, you must have complained to the organisation directly and given it an opportunity to resolve the matter. Only in exceptional circumstances will we consider complaints where you have not initially complained to the organisation (see Question 5).