How we investigate and resolve your complaint
On this page
- We will decide if we can investigate your complaint
- We may need to disclose your personal information or collect more of it when investigating your complaint
- We try to get you and the business you complained about to agree on an outcome
The OAIC acts as an impartial third party when investigating and resolving a complaint. We don’t act for you or the business you complained about.
Deciding if we can investigate your complaint
Before we decide whether to investigate your complaint, we may need more information. In this situation, we may contact you, the business you complained about, or any relevant third party to collect more information about your complaint. If we think we can resolve your complaint during this process, we will attempt to do so.
If your complaint is about something we can’t investigate, we will let you know and close your complaint. You can appeal our decision.
We can’t investigate an anonymous complaint.
What we may not investigate
Generally speaking, we may not investigate your complaint if:
- it doesn’t involve your Consumer Data Right (CDR) data
- you haven’t first complained to the business you think has mishandled your data or they haven’t had an opportunity to respond to your complaint
- you are complaining about something you found out about more than 12 months ago
- the matter is best dealt with by an external dispute resolution scheme recognised by the Australian Competition and Consumer Commission (ACCC) to consider complaints related to the Consumer Data Right
- the matter is best dealt with under another law or by another agency or organisation.
Investigating your complaint
If we decide to investigate your complaint, we will usually write to the business you complained about. We will tell them about your complaint and ask for their response. We will also give them a copy of your complaint to us.
We will let you know, in writing, of the progress of your complaint.
If necessary, we may also disclose your personal information to any third party who has information relevant to your complaint. This may include the ACCC, which also regulates the Consumer Data Right system.
If we think we may need to disclose your personal information to an overseas organisation or agency, we will discuss this with you first.
We may need to collect more information from you to investigate your complaint. If you don’t give us this information, it may affect how we handle your complaint. In some situations, it may mean we decide not to investigate your complaint any further.
We will usually collect information about you from the business you complained about. We may also collect information about you from others if they have information relevant to your complaint.
Resolving your complaint
Generally, we will discuss the issues you raised in your complaint with you and the business you complained about. You need to tell us the outcome you want.
We will try to get both you and the business you complained about to agree on an outcome, rather than us deciding what should happen. There are many possible outcomes.
If you and the business you complained about agree on an outcome to resolve your complaint, we will close your complaint. If you and the business you complained about can’t agree on an outcome, we will decide what should happen.
If we think the business you complained about has proposed a reasonable outcome but you are not happy with it, we may close your complaint because the business has adequately dealt with the matter, even though you don’t agree.
If we don’t think the matter has been resolved or the business you complained about hasn’t adequately dealt with the matter, we will make a formal decision, called a determination, which states what the business must do.
You can choose to withdraw your complaint at any time without penalty.
A possible outcome for a complaint may be:
- taking steps to address the matter, such as having a record corrected
- an apology
- a change to the practices or procedures of the business you complained about
- training staff
- compensation for financial or non-financial loss
- other non-financial options, such as a complimentary subscription to a service.
In some situations, we may also accept an undertaking from the business to do, or stop doing, a specific thing so they don’t breach the CDR privacy safeguards. If they fail to meet the undertaking, we can ask a court to enforce it.
Where a breach of privacy is very serious, we may seek a civil penalty. A civil penalty is like a fine and is not paid to you.