Complaints About Breaches of Privacy

If you’re concerned about how your personal information has been handled by an ACT public sector agency, you can complain to us:

• It is free to lodge a complaint.
• Complaints are generally resolved through conciliation.
• You don’t need legal representation to make the complaint.

Who can you complain about?

ACT public sector agencies are covered by the Information Privacy Act 2014. This includes:

• administrative units
• statutory office-holders and their staff
• territory authorities
• territory instrumentalities
• territory-owned corporations
• ACT courts (in their administrative capacities)
• ministers (in their administrative capacities)
• any entity prescribed by regulation

The Information Privacy Act also applies to some businesses that are contracted service providers (including subcontractors) to the ACT Government.

What can you complain about?

You can make a complaint about the handling of your personal information. Personal information is information or an opinion that identifies, or could identify, you.

The Territory Privacy Principles (TPPs) in Schedule 1 of the Information Privacy Act outline how your personal information must be handled. You can complain if you think your information has not been handled appropriately under the TPPs. The principles cover:

• open and transparent management of personal information
• anonymity and pseudonymity
• notice of collection
• use and disclosure, including overseas disclosure
• accuracy and quality of personal information
• security of storage
• access and correction.

How do you make a complaint?

Complaints to the ACT Human Rights Commission about a privacy concern can be made by filling in the Make a Complaint form or sending an email to human.rights@act.gov.au.

If you cannot write the complaint down you can call and we can assist you to write the complaint down.

To make a complaint you must give us your name and contact details.

Under the IPA we can not handle anonymous complaints about alleged privacy breaches.

Where possible, your complaint should also include:

• the details of the public sector agency or contracted service provider you are complaining about
• a description of the privacy issue
• details of any contact you have had with the agency about the issue
• copies of any relevant documents
• what outcome you are seeking to resolve the complaint.

If you need help lodging a complaint, you can contact us.

If you are representing someone else when lodging the complaint, you must make this clear when you lodge the complaint. You will also need to include consent from that person to make the complaint on their behalf.

How we will handle your complaint

When we receive your complaint we will assess whether the issue is covered by the Information Privacy Act. If it is, we will contact you and decide how best to progress the matter. This might be trying to resolve the matter informally with the respondent or we might seek a written response to the concerns you have raised.

Usually, we will contact the respondent and ask for information about the issues raised by the complaint.

We usually provide the public sector agency with a copy of the complaint. If you are complaining about a contracted service provider, a copy of the complaint will usually be provided to both the contracted service provider, and the public sector agency to which the contract relates.

In most cases we will attempt to resolve the complaint by helping you and the respondent reach an agreement. Our role in this process is to act as an impartial third party. We do not act as an advocate for either party.

Possible outcomes may include the agency or service provider:

• taking steps to address the matter, for example providing access to personal information, or amending records
• providing an apology
• making a change to their practices or procedures
• undertaking staff training
• providing compensation for financial or non-financial loss.

If you and the respondent agree on an outcome to resolve the issue, we will close your complaint. If you and the respondent cannot reach an agreement, we will make a decision on what should happen.

If we think the respondent has proposed a reasonable outcome, but you have not accepted it, we may finalise your complaint on the grounds that the respondent has adequately dealt with the matter.

If we do not think that the matter has been resolved or been adequately dealt with by the respondent, we may find that there has been an interference with your privacy.

Application to Court

If we find that there has been an interference with your privacy under the Information Privacy Act, and the complaint is not resolved by agreement between you and the respondent, we will issue a notice that outlines our findings. You then have the right to apply to the ACT Magistrates Court for a Court order based on these findings.

You will need to apply to the Court within 6 months of being issued with our notice. When they consider your application, the Court may find that there has been an interference with your privacy. They will then make an order stating one or more of the following:

• the respondent must stop the act or practice complained about
• the respondent must undertake a reasonable act or practice to compensate you
• the respondent must make certain amendments to the records it holds
• you are entitled to financial compensation for economic loss that you have incurred as a result of the act or practice complained about
• no further action needs to be taken by the respondent.

In addition, the Court may order that you are reimbursed for costs that you have reasonably incurred in making the complaint.

Alternatively, the Court may find that there has not been an interference with your privacy, and that your application should be dismissed.

It is important to note that we cannot assist you with taking your matter to Court.