Chapter 8A: Compliance notices

Version 1.0

Introduction

8.1 A compliance notice is a notice issued by a regulatory authority or enforcement agency, to a person or entity, that sets out the particulars of an alleged contravention of a legislative obligation. It states the actions the entity must take (or refrain from taking) to address the contravention or to ensure the conduct constituting the contravention is not repeated.

8.2 Issuing a compliance notice provides the entity with a pathway to comply with its obligations after receiving information about actions they must take. Where the entity complies with the notice, it can avoid a pecuniary penalty for the contravention.

8.3 If an entity does not comply with a compliance notice, the OAIC may issue an infringement notice against that entity for failure to comply with the compliance notice in the time set out in the notice. However, a compliance notice is not required prior to the issuance of an infringement notice. These regulatory tools can operate independently.

Legislative framework

8.4 Section 80UC of the Privacy Act empowers the Commissioner and the OAIC’s Senior Executive Service staff (SES), to issue a compliance notice where the decision maker reasonably believes that an entity has contravened one of the compliance notice provisions under s 13K(1) and (2) of the Privacy Act.[1]

8.5 An entity contravenes s 13K(1) of the Privacy Act if they engage in an act or practice that breaches any of the following APP provisions: APPs 1.3, 1.4, 2.1, 6.5, 7.2(c) or 7.3(c), 7.3(d), 7.7(a), 7.7(b) and 13.5.

8.6 An entity contravenes s 13K(2) of the Privacy Act if the entity prepares a statement under s 26WK of the Privacy Act and the statement does not comply with ss 26WK(3).

Purpose and key features of a compliance notice

8.7 A compliance notice is a discretionary notice which the OAIC may issue to an entity.

8.8 A compliance notice is intended to provide an entity with practical and measurable steps it can take to comply with the obligations set out in s 13K(1) and (2) of the Privacy Act. The notice is intended to help the entity better understand and comply with its privacy obligations in a timely manner, promoting the right to privacy through supporting a higher standard of personal information handling practices.[2]

When will a compliance notice be issued

8.9 The OAIC may issue a compliance notice for an alleged contravention of s 13K(1) or (2) of the Privacy Act if the relevant decision maker reasonably believes that the entity has contravened that section.[3]

8.10 Whether there are reasonable grounds for forming a belief is both an objective and subjective test. The reasonable belief must be based on the facts of each matter. The reasonable belief must also be held subjectively by the person issuing the notice. The OAIC cannot issue an entity with a compliance notice and an infringement notice for the same contravention at the same time. [4]

8.11 Further, the OAIC cannot seek an order for a civil penalty in relation to a contravention of sections 13G(1), 13H(1) or 13K(1) or (2) if the entity has been issued with a compliance notice in relation the same conduct and:

• the notice has not been withdrawn and the entity has complied with the notice; or
• the entity applied to the Federal Court or the Federal Circuit and Family Court of Australia (Division 2) for review of the notice and the application has not been completely dealt with.[5]

Multiple compliance notices

8.12 A compliance notice issued under s 80UC(1) of the Privacy Act will set out the particulars of the alleged contravention of the compliance notice provisions.

8.13 Where there has been more than one contravention of a compliance notice provision, the OAIC may issue the recipient with multiple compliance notices, each relating to a separate contravention.[6]

Content of a compliance notice

8.14 A compliance notice issued to a recipient must:

• set out the name of the entity to whom the notice is issued;
• set out the details of the contravention;
• specify either:
  • the action the entity must take, or refrain from taking, within a reasonable period specified in the notice, to address the contravention; or
  • the steps the entity must take, within a reasonable period specified in the notice, to ensure the conduct constituting the contravention is not repeated or continued
• explain that a failure to comply with the notice may contravene a civil penalty provision; and
• explain that the entity may apply to the Federal Court or the Federal Circuit and Family Court of Australia (Division 2) for a review of the notice on either or both of the following grounds:
  • the entity has not committed the contravention set out in the notice; or
  • the notice does not comply with the requirements set out in ss 80UC(2) of the Privacy Act.

8.15 The notice may also require the entity - external site to produce, within a reasonable period specified in the notice, reasonable evidence of compliance with the notice.[7]

The decision to issue a compliance notice

8.16 The OAIC will decide whether to issue a compliance notice on a case-by-case basis and will do so in circumstances where it is considered that the relevant alleged contravention is reasonably able to be remedied by the entity.

8.17 In deciding whether to issue a compliance notice, the OAIC will refer to its statement of regulatory approach[8] as well as the factors set out in the Privacy regulatory action policy. [9]

8.18 The OAIC is less likely to consider issuing a compliance notice where the concerns are more serious in nature and warrant consideration by a court, or where there have been significant impacts arising from the alleged contravention of APP obligations.

Issuing a compliance notice

8.19 If the OAIC has reasonable grounds to believe that an entity has contravened s 13K(1) or (2) of the Privacy Act, it may issue the entity with a compliance notice without first engaging with the entity.

8.20 This is because the compliance notice provisions under s 13K(1) and (2) of the Privacy Act are intended to enable the OAIC to respond quickly to relatively low-level or straightforward contraventions of the Privacy Act.[10]

8.21 A compliance notice may also be issued following other regulatory action with the entity, for example the investigation of a privacy complaint about an APP entity.[11]

Receiving a compliance notice and resultant action

8.22 A compliance notice issued under s 80UC(1) of the Privacy Act will explain the steps the entity must take, or refrain from taking, within a reasonable period specified in the notice, to address the contravention, or to ensure the conduct constituting the contravention is not repeated or continued.

8.23 What constitutes a reasonable period is an objective test determined on the facts of the matter. Relevant considerations may include the complexity of the steps the entity is being asked to take or refrain from taking; the level of privacy risk for individuals generated by the alleged contravention and whether the entity responsible has been the subject of prior compliance or regulatory enforcement by the OAIC (in respect of the same issue), and the outcome of that action.

Seeking review of the notice

8.24 The recipient of a compliance notice may apply to the Federal Court or the Federal Circuit and Family Court of Australia (Division 2) for a review of the notice on either or both of the following grounds:

• the entity has not committed the contravention set out in the notice; or
• the notice does not comply with the requirements set out in ss 80UC(2) of the Privacy Act.

8.25 The recipient may also request that the person who issued the notice consider revoking or varying the notice.[12]

8.26 Where the OAIC receives a request for a notice to be varied or revoked, the OAIC will consider any relevant information the entity provides about why the notice should be varied or revoked and provide a response in writing.

8.27 If a compliance notice is revoked, varied or set aside, the OAIC will consider on a case-by-case basis whether further action is appropriate. That action could include the institution of proceedings for the alleged contravention of a compliance notice provision, to seek the civil penalty set out in the relevant section.

Implications of complying with a compliance notice

8.28 If the recipient complies with the compliance notice within the reasonable period provided, the recipient is not taken to:

• having admitted to contravening the compliance notice provision[13]
• having been found to have contravened the compliance notice provision.[14]

Implications of not complying with a compliance notice

8.29 Where an entity fails to comply with a compliance notice, this amounts to a contravention of s 80UC(4) of the Privacy Act, a civil penalty provision. In these circumstances, the OAIC may:

• issue an infringement notice for contravention of s 80UC(4) of the Privacy Act
• issue civil penalty proceedings for contravention of a civil penalty provision, or
• make a determination under s 52(1A) of the Privacy Act.[15]

8.30 An infringement notice for a single contravention of s 80UC(4) of the Privacy Act attracts a penalty of the lesser of:

• one-fifth of the maximum penalty that a court could impose on the person for that contravention and
• 12 penalty units for an individual, 60 penalty units for a body corporate.

8.31 An infringement notice for a single contravention of s 80UC(4) of the Privacy Act by a listed corporation attracts a penalty of 200 penalty units.[16]

8.32 The maximum penalty payable by order of a court for contravention of s 80UC(4) is 200 penalty units.[17]

8.33 When determining which regulatory action to take in response to non-compliance with a compliance notice, the OAIC will consider the factors set out in the Privacy Regulatory Action Policy[18] and its Statement of Regulatory Approach.[19]

8.34 Where multiple compliance notices are issued and the entity does not comply with each notice, the OAIC may issue an infringement notice for each compliance notice not complied with. Each instance of non-compliance also attracts a civil penalty of up to 200 penalty units.