Resolving privacy complaints
Privacy complaints are by their nature stressful for both the complainant and the agency. The complainant is often upset about the manner in which their personal information has been handled, and they may feel angry with the agency while the agency is in the position of having its decision, acts or practices questioned.
A key challenge is repairing the relationship between the agency and the complainant. The Office of the Information Commissioner’s (OIC) experience is that significant factors in an agency successfully resolving a complaint are showing a willingness to acknowledge the complainant’s concerns, and responding to their concerns in a timely manner.
If an agency does not handle a complaint effectively, this can compound the complainant’s grievance. In some cases, this can result in a complainant changing the focus of their complaint from their substantive issue, to include how their privacy complaint is being handled by the agency.
A complainant who feels that they have been treated fairly and with respect will be more open to considering the agency’s position and be more willing to seek resolution. This could mean a quicker and less stressful complaint resolution process for everyone.
A recent privacy complaint received by OIC highlighted how a willingness by the agency to understand the complainant’s concerns, and the timeliness of their response, was instrumental in resolving the complaint.
The complainant made an appointment with a public authority (the agency) to seek advice and discuss options regarding a service provided by the agency. During the meeting, the agency used a questionnaire to frame its discussions with the complainant, which involved collecting and recording personal information from the complainant.
The complainant subsequently decided not to use the service provided by the agency and requested that the agency delete some of the personal information recorded on the questionnaire as the information was no longer accurate. The agency refused to do so for the reason that Queensland Government agencies have a responsibility under the Public Records Act 2002 (Qld) to create and manage full and accurate records of its activities, and that these records must then be retained in accordance with Retention and Disposal Schedules approved by the State Archivist.
The complainant alleged that the agency’s refusal to delete their personal information was a breach of their privacy.
The alleged breach of the privacy principles
Information Privacy Principle 7 requires agencies to take all reasonable steps, including the making of an appropriate amendment, to ensure that its personal information holdings are accurate, relevant, complete, up-to-date and not misleading.
Outcome of the complaint
OIC contacted the agency as part of its preliminary inquiries and sought clarification on the circumstances in which this advice was provided. The agency confirmed its position that it was unable to delete the complainant’s personal information due to legislative record-keeping requirements. The agency indicated that it recognised it could have explained more clearly to the complainant the capacity for the addition of a notation to the document where the complainant believed that the information was inaccurate or misleading.
The agency acknowledged the complainant’s concerns and proposed making an apology to the complainant and attaching an appropriate notation to the document. The complainant agreed to this proposal. The agency then contacted the complainant and verbally apologised for their communications with the complainant, and followed this up with a letter which reiterated their apology and confirmed that a notation had been added to the document which stated the personal information was not up-to-date and was not to be used. The letter also informed the complainant that additional measures had been put in place to restrict access to the document. Both the phone call and letter were provided within a week of the complainant acknowledging she would accept the agency’s proposal.
The complainant subsequently indicated that these actions by the agency resolved her privacy complaint. The agency used the complaint as an opportunity to improve its service by reminding staff that any privacy-related issues are to be referred to the agency’s Privacy Contact Officer.