How to make a privacy complaint

Complain to the agency

If you think a Queensland government agency didn't follow the rules in the Information Privacy Act 2009 (IP Act) with your personal information, you can make a privacy complaint by following the steps below.

This page won't help you make a privacy complaint about a company, private healthcare provider, or private citizen. The Office of the Australian Information Commissioner or the Queensland Police Service may be able to help.

Step one: check the agency’s website for information about how to make a complaint to them. There should be a link to privacy information at the bottom of the page.

Step two: write your complaint down. You need to include enough detail so that the privacy officer can investigate your complaint.

Step three: send your written privacy complaint to the agency using the information from step one. Make sure you include your name and address. This can be an email address.

You can't complain about someone else's personal information, unless:

you're a parent making a complaint for your child about the child's personal information; or
you have been authorised by someone else to make a complaint for them about their personal information.

Important

You must make a privacy complaint within 12 months of finding out the agency may have breached your privacy.

How long does it take?

The agency has 45 business days to give you a response. They may contact you during that time to ask you for more information or to discuss what they’ve found.

The agency can also ask you for extra time, but you do not have to agree.

What if I’m not happy with the response?

If you get a response you’re not happy with, or you do not get a response in time, you can bring your privacy complaint to the OIC.

Bring your complaint to the OIC

You need to complete the form to:

tell us who you are
give us an address we can send correspondence to; and
describe what the agency did with your personal information that you think broke the rules in the IP Act.

It's helpful if you include a copy of the original complaint and any correspondence between you and the agency.

Your complaint must be in writing, but if you have difficulties, for example due to a disability, the OIC can help you put it in writing. If you are not able to use the form, you can send your complaint to us by post or email.

Submit a privacy complaint

What happens at OIC?

The first thing we do is acknowledge that we have received your complaint. We aim to do this within five business days of receiving your complaint. Sometimes it may take longer, but we will contact you as soon as we can.

We have to follow the rules in the IP Act, which means that we need to assess your complaint to work out:

if we are authorised to deal with it; and
if there is a reason we might decline to deal with it.

‘Deal with a complaint’ means accept it and try and mediate an outcome.

Some of the reasons we might not deal with your complaint are:

you did not complain to the agency first
you did not give the agency at least 45 business days to respond to your complaint
the complaint is not about your personal information
there is an exception in the IP Act that means what you are complaining about is not covered by the IP Act
there is a more appropriate course of action available under another Act to deal with your complaint; or
you became aware of the issue more than 12 months ago.

We may also decline to deal with your privacy complaint if you do not cooperate with us or comply with our reasonable requests, or if we are unable to contact you at the address you gave us.

What can the OIC do?

We cannot investigate a privacy complaint. We do not have the power to decide whether or not there was a privacy breach, order compensation, or penalise an agency.

We only have the power to assess whether your complaint shows an ‘arguable case’ that there has been a privacy breach. If it does, we can provide a mediation service.

If we accept a complaint, we take all reasonable steps to help both parties resolve it by mediation, as long as it is appropriate to do so.

How does mediation work?

Mediation is an informal process and is voluntary for both parties.

Mediation is about the steps that an agency can take to remedy any damage that was caused by the alleged privacy breach. It is not about placing blame or handing out punishment. For example, an agency cannot be fined under the IP Act for breaching someone’s privacy.

You and the agency will have equal say on the resolution of your complaint. This means you will have the chance to provide your point of view and suggest ways to resolve the complaint.

We typically conduct mediation by contacting both parties individually, either by telephone or in writing. In some instances we may attempt to resolve a complaint by facilitating a meeting between you and the respondent agency, either face-to-face or by teleconference.

What do I have to do?

We will treat you with courtesy and respect at all times and we expect that you will treat us the same way.

We expect you to act in good faith during the mediation process. For example, by:

suggesting genuine options for resolving your complaint
being open and honest in your communications; and
being willing to listen to the agency’s point of view and consider their position.

If you change your address during the complaint process, you must let us know as we need to be able to keep you informed about the progress of your complaint. If we cannot contact you, we can stop dealing with your complaint.

During the mediation process you may be asked to give us written material. Where appropriate, as a matter of procedural fairness, copies of this material or relevant parts of it may be given to the agency. It is important that you tell us if there is anything in your material that you do not want the agency to see.

What outcomes can be achieved through mediation?

Successful resolution of a privacy complaint requires a settlement proposal that is acceptable to you and the agency. Ideally, it will help restore the relationship between you and the agency and improve the agency’s systems and practices.

Agreement is commonly reached when both parties are flexible in what they are prepared to offer and to accept in order to resolve the complaint.

When you are working out what outcome you would accept to resolve the complaint, you might want to consider any damage you might have suffered as a direct result of the alleged privacy breach and what the agency could do to make up for it.

How long will it take to mediate my complaint?

We aim to finalise complaints within 90 days of the complaint being accepted, but in some cases it can take longer. This can happen, for example, where the complaint raises complex issues or it takes longer than expected to gather information or for you and the agency to discuss resolution options.

What happens if resolution cannot be reached?

If it appears to us that resolution of the complaint is not reasonably likely to be achieved through mediation, we will send you a written notice.

You will then have the option to ask us to refer your privacy complaint to the Queensland Civil and Administrative Tribunal (QCAT) for hearing and determination. You must ask us to do this within 20 business days of the date on the notice.