On this page
- We will decide if we can investigate your complaint
- We may need to disclose your personal information or collect more of it when investigating your complaint
- We try to get you and the business you complained about to agree on an outcome
The OAIC acts as an impartial third party when investigating and resolving a complaint. We don’t act for you or the business you complained about.
Deciding if we can investigate your complaint
Before we decide whether to investigate your complaint, we may need more information. In this situation, we may contact you, the business you complained about, or any relevant third party to collect more information about your complaint. If we think we can resolve your complaint during this process, we’ll attempt to do so.
If your complaint is about something we can’t investigate, we’ll let you know and close your complaint. You can appeal our decision.
We can’t investigate an anonymous complaint.
What we may not investigate
Generally speaking, we may not investigate your complaint if:
- it doesn’t involve your CDR data
- you haven’t first complained to the business you think has mishandled your CDR data or they haven’t had an opportunity to respond to your complaint
- you’re complaining about something you found out about more than 12 months ago
- the matter is best dealt with by an external dispute resolution scheme recognised by the Australian Competition and Consumer Commission (ACCC) to consider CDR-related complaints
- the matter is best dealt with under another law or by another agency or organisation
Investigating your complaint
If we decide to investigate your complaint, we usually write to the business you complained about. We tell them about your complaint and ask for their response. We also give them a copy of your complaint to us.
We’ll let you know, in writing, of the progress of your complaint.
If necessary, we may also disclose your personal information to any third party who has information relevant to your complaint. This may include the ACCC, which also regulates the CDR system.
If we think we may need to disclose your personal information to an overseas organisation or agency, we’ll discuss this with you first.
We may need to collect more information from you to investigate your complaint. If you don’t give us this information, it may affect how we handle your complaint. In some situations, it may mean we decide not to investigate your complaint any further.
We usually collect information about you from the business you complained about. We may also collect information about you from others if they have information relevant to your complaint.
Resolving your complaint
Generally, we discuss the issues you raised in your complaint with you and the business you complained about. You need to tell us the outcome you want.
We try to get you both you and the business you complained about to agree on an outcome, rather than us deciding what should happen. There are many possible outcomes.
If you and the business you complained about agree on an outcome to resolve your complaint, we’ll close your complaint. If you and the business you complained about can’t agree on an outcome, we’ll decide what should happen.
If we think the business you complained about has proposed a reasonable outcome but you’re not happy with it, we may close your complaint because the business has adequately dealt with the matter, even though you don’t agree.
If we don’t think the matter has been resolved or the business you complained about hasn’t adequately dealt with the matter, we will make a formal decision, called a determination, which states what the business must do.
You can choose to withdraw your complaint at any time without penalty.
A possible outcome for a complaint may be:
- taking steps to address the matter (such as having a record corrected)
- an apology
- a change to the practices or procedures of the business you complained about
- training staff
- compensation for financial or non-financial loss
- other non-financial options (such as a complimentary subscription to a service)
In some situations, we may also accept an undertaking from the business to do, or stop doing, a specific thing so they don’t breach the Privacy Safeguards. If they fail to meet the undertaking, we can ask a court to enforce it.
Where a breach of privacy is very serious, we may seek a civil penalty. A civil penalty is like a fine and is not paid to you.
Was this page helpful?
If you would like to provide more feedback, please email us at email@example.com