If you’re concerned about how your personal information has been handled by an ACT public sector agency, you can complain to us (the OAIC):
It is free to lodge a complaint.
Complaints are generally resolved through conciliation.
You don’t need legal representation to make the complaint.
You can choose to withdraw your complaint at any time.
Who can you complain about?
ACT public sector agencies are covered by the Information Privacy Act 2014 (Information Privacy Act). This includes:
ministers (in their administrative capacities)
administrative units
statutory office-holders and their staff
territory authorities
territory instrumentalities
territory-owned corporations
ACT courts (in their administrative capacities)
any entity prescribed by regulation
The Information Privacy Act also applies to some businesses that are contracted service providers (including subcontractors) to the ACT Government.
What can you complain about?
You can make a complaint about the handling of your personal information. Personal information is information or an opinion that identifies, or could identify, you.
The Territory Privacy Principles (TPPs) in Schedule 1 of the Information Privacy Act outline how your personal information must be handled. You can complain if you think your information has not been handled appropriately under the TPPs. The principles cover:
open and transparent management of personal information
anonymity and pseudonymity
notice of collection
use and disclosure, including overseas disclosure
accuracy and quality of personal information
security of storage
access and correction
What do you need to do before making a complaint?
Before you lodge a complaint with us, you should complain directly to the relevant public sector agency (or contracted service provider) (the respondent). You should give them 30 days to respond to your complaint. If you don't receive a response after 30 days, or you're not satisfied with the response, you can complain to the OAIC.
How do you make a complaint?
Complaints to us should be made in writing, and must include your name and contact details. We cannot handle anonymous complaints.
Your complaint should also include:
the details of the public sector agency or contracted service provider you are complaining about
a description of the privacy issue
details of any response, or correspondence, you have received
copies of any relevant documents
details of the resolution you would like
If you need help lodging a complaint, you can call us.
If you are representing someone else when lodging the complaint, you must make this clear when you lodge the complaint. You will also need to include a written authority to act on their behalf.
Will we investigate your complaint?
When we receive your complaint we will assess whether the issue is covered by the Information Privacy Act. If it is, we will be able to investigate your complaint.
In some cases we may not be able to deal with your complaint. Some examples where we are not able to deal with your complaint include:
you have known about the issue for more than 12 months
your complaint is better dealt with, or has been dealt with, under another law or by another body
the respondent has adequately dealt with the matter
your information has been handled in accordance with the TPPs and there has not been an interference with your privacy
the respondent has not had enough time to deal with the complaint
If we cannot deal with your complaint we will let you know and tell you why.
What happens to your complaint?
Usually, we will contact the respondent and ask for information about the issues raised by the complaint.
We usually provide the public sector agency with a copy of the complaint. If you are complaining about a contracted service provider, a copy of the complaint will usually be provided to both the contracted service provider, and the public sector agency to which the contract relates.
In most cases we will attempt to resolve the complaint by helping you and the respondent reach an agreement. Our role in this process is to act as an impartial third party. We do not act as an advocate for either party.
Possible outcomes may include the agency or service provider:
taking steps to address the matter, for example providing access to personal information, or amending records
providing an apology
making a change to their practices or procedures
undertaking staff training
providing compensation for financial or non-financial loss
If you and the respondent agree on an outcome to resolve the issue, we will close your complaint. If you and the respondent cannot reach an agreement, we will make a decision on what should happen.
If we think the respondent has proposed a reasonable outcome, but you have not accepted it, we may finalise your complaint on the grounds that the respondent has adequately dealt with the matter.
If we do not think that the matter has been resolved or been adequately dealt with by the respondent, we may find that there has been an interference with your privacy.
Application to Court
If we find that there has been an interference with your privacy under the Information Privacy Act, and the complaint is not resolved by agreement between you and the respondent, we will issue a notice that outlines our findings. You then have the right to apply to the ACT Magistrates Court for a Court order based on these findings.
You will need to apply to the Court within 6 months of being issued with our notice. When they consider your application, the Court may find that there has been an interference with your privacy. They will then make an order stating one or more of the following:
the respondent must stop the act or practice complained about
the respondent must undertake a reasonable act or practice to compensate you
the respondent must make certain amendments to the records it holds
you are entitled to financial compensation for economic loss that you have incurred as a result of the act or practice complained about
no further action needs to be taken by the respondent
In addition, the Court may order that you are reimbursed for costs that you have reasonably incurred in making the complaint.
Alternatively, the Court may find that there has not been an interference with your privacy, and that your application should be dismissed.
It is important to note that we cannot assist you with taking your matter to Court.
