Make a privacy complaint in the ACT
If you’re concerned about how your personal information has been handled by an ACT public sector agency, you can complain to us (the OAIC):
- It is free to lodge a complaint.
- Complaints are generally resolved through conciliation.
- You don’t need legal representation to make the complaint.
- You can choose to withdraw your complaint at any time.
Who can you complain about?
ACT public sector agencies are covered by the Information Privacy Act 2014 (Information Privacy Act). This includes:
- ministers (in their administrative capacities)
- administrative units
- statutory office-holders and their staff
- territory authorities
- territory instrumentalities
- territory-owned corporations
- ACT courts (in their administrative capacities)
- any entity prescribed by regulation
The Information Privacy Act also applies to some businesses that are contracted service providers (including subcontractors) to the ACT Government.
What can you complain about?
You can make a complaint about the handling of your personal information. Personal information is information or an opinion that identifies, or could identify, you.
The Territory Privacy Principles (TPPs) in Schedule 1 of the Information Privacy Act outline how your personal information must be handled. You can complain if you think your information has not been handled appropriately under the TPPs. The principles cover:
- open and transparent management of personal information
- anonymity and pseudonymity
- notice of collection
- use and disclosure, including overseas disclosure
- accuracy and quality of personal information
- security of storage
- access and correction
What do you need to do before making a complaint?
Before you lodge a complaint with us, you should complain directly to the relevant public sector agency (or contracted service provider) (the respondent). You should give them 30 days to respond to your complaint. If you don't receive a response after 30 days, or you're not satisfied with the response, you can complain to the OAIC.
How do you make a complaint?
Complaints to us should be made in writing, and must include your name and contact details. We cannot handle anonymous complaints.
Your complaint should also include:
- the details of the public sector agency or contracted service provider you are complaining about
- a description of the privacy issue
- details of any response, or correspondence, you have received
- copies of any relevant documents
- details of the resolution you would like
If you need help lodging a complaint, you can call us.
If you are representing someone else when lodging the complaint, you must make this clear when you lodge the complaint. You will also need to include a written authority to act on their behalf.
Will we investigate your complaint?
When we receive your complaint we will assess whether the issue is covered by the Information Privacy Act. If it is, we will be able to investigate your complaint.
In some cases we may not be able to deal with your complaint. Some examples where we are not able to deal with your complaint include:
- you have known about the issue for more than 12 months
- your complaint is better dealt with, or has been dealt with, under another law or by another body
- the respondent has adequately dealt with the matter
- your information has been handled in accordance with the TPPs and there has not been an interference with your privacy
- the respondent has not had enough time to deal with the complaint
If we cannot deal with your complaint we will let you know and tell you why.
What happens to your complaint?
Usually, we will contact the respondent and ask for information about the issues raised by the complaint.
We usually provide the public sector agency with a copy of the complaint. If you are complaining about a contracted service provider, a copy of the complaint will usually be provided to both the contracted service provider, and the public sector agency to which the contract relates.
In most cases we will attempt to resolve the complaint by helping you and the respondent reach an agreement. Our role in this process is to act as an impartial third party. We do not act as an advocate for either party.
Possible outcomes may include the agency or service provider:
- taking steps to address the matter, for example providing access to personal information, or amending records
- providing an apology
- making a change to their practices or procedures
- undertaking staff training
- providing compensation for financial or non-financial loss
If you and the respondent agree on an outcome to resolve the issue, we will close your complaint. If you and the respondent cannot reach an agreement, we will make a decision on what should happen.
If we think the respondent has proposed a reasonable outcome, but you have not accepted it, we may finalise your complaint on the grounds that the respondent has adequately dealt with the matter.
If we do not think that the matter has been resolved or been adequately dealt with by the respondent, we may find that there has been an interference with your privacy.
Application to Court
If we find that there has been an interference with your privacy under the Information Privacy Act, and the complaint is not resolved by agreement between you and the respondent, we will issue a notice that outlines our findings. You then have the right to apply to the ACT Magistrates Court for a Court order based on these findings.
You will need to apply to the Court within 6 months of being issued with our notice. When they consider your application, the Court may find that there has been an interference with your privacy. They will then make an order stating one or more of the following:
- the respondent must stop the act or practice complained about
- the respondent must undertake a reasonable act or practice to compensate you
- the respondent must make certain amendments to the records it holds
- you are entitled to financial compensation for economic loss that you have incurred as a result of the act or practice complained about
- no further action needs to be taken by the respondent
In addition, the Court may order that you are reimbursed for costs that you have reasonably incurred in making the complaint.
Alternatively, the Court may find that there has not been an interference with your privacy, and that your application should be dismissed.
It is important to note that we cannot assist you with taking your matter to Court.