About privacy complaints
What is a privacy complaint?
After 1 December 2009 (or 1 July 2010 for local government) an individual became able to make a complaint that an agency had breached its obligations under the Information Privacy Act 2009 (Qld) (IP Act) to comply with the:
- privacy principles; and/or
- conditions attached to a public interest approval granted under section 157 of the IP Act.
Who can you complain about?
Generally speaking, the privacy principles apply to all Queensland government agencies including Departments, public authorities and local government. However, there are exceptions.
How do you make a complaint?
The Information Privacy Act 2009 (Qld) (IP Act) sets out the steps you can take to make a privacy complaint.
1. Making a complaint to the relevant agency
If you are concerned that an agency has breached your privacy on or after 1 December 2009 (or 1 July 2010 in the case of local government), you should first speak with the responsible officer in the agency. If you are not satisfied with the agency’s verbal response, you are able to make a formal written complaint. To do this, you should write to the agency explaining why you consider the agency has failed to fulfil its obligations to comply with the requirements of the IP Act. If the agency does not respond within 45 business days, or you are not satisfied with its response, you can lodge a written complaint with the Office of the Information Commissioner (OIC).
This guide will help you identify key steps you can take to minimise any risk of harm from a privacy breach: What to do if you’re affected by a privacy breach
2. Making a complaint to the Information Commissioner
If you have complained to the agency under the IP Act, given the agency 45 business days to respond and you are not satisfied with the agency’s response, you can refer your privacy complaint to the OIC.
A complaint lodged with OIC must be:
- written
- state an address to which notices under the IP Act can be sent; and
- give particulars of the act or practice complained of.
The Privacy Complaint Form will assist you to make a privacy complaint to OIC. A Checklist is available to help you work out if you have a valid complaint. Please include a copy of your complaint to the agency together with their response (if you have received one).
OIC provides a mediation service. If OIC decides to accept the complaint, OIC must consider whether the privacy complaint can be resolved between the individual and the agency and then take all reasonable steps to effect that resolution. For more information regarding the OIC’s privacy complaint resolution process, read our Privacy Complaint Handling Policy.
3. Making a complaint to the Queensland Civil and Administrative Tribunal
If a settlement cannot be reached in the complaint, the complainant can ask OIC to refer the complaint to the Queensland Civil and Administrative Tribunal (QCAT). QCAT has the power to hear and determine the subject matter of the privacy complaint. The individual and the agency will be the parties to the hearing before QCAT.
After hearing the evidence and representations of the parties, QCAT may find the complaint or any part of it proven. In that instance QCAT may make an order restraining the agency from repeating any act or practice, order the agency to carry out certain acts, award compensation to the complainant not exceeding $100,000 and/or make further orders against the agency.
