What to expect when you bring a privacy complaint to OIC - A guide for complainants

This Information Sheet outlines what you can expect when you bring a privacy complaint to the Office of the Information Commissioner (OIC) and how you can maximise the effectiveness of the complaints process.

If you would like advice about what you need to do before you can bring your privacy complaint to us, please see our Checklist: Can I make a privacy complaint to OIC?

What happens after I lodge a complaint with OIC?

The first thing we do is acknowledge that we have received your complaint.  We aim to do this, either by telephone or in writing, within five business days of receiving your complaint.

We then assess your complaint to determine whether we are authorised to deal with it.  There are a number of reasons why we may decline to deal with your complaint, including where:

• you have not first complained to the agency and allowed them the minimum time of 45 business days to deal with your complaint
• the complaint does not concern your personal information¹
• more than 12 months has passed since you first became aware of the act or practice about which you are complaining
• there is insufficient evidence to support the alleged breach
• the complaint demonstrates an error in fact; or
• there is an exception in the Information Privacy Act 2009 (Qld) (IP Act) that applies to the subject matter of your complaint.

The IP Act does not give OIC powers to determine whether a privacy breach has occurred, or to impose a particular settlement.  Rather, our role is to assess whether your complaint shows an ‘arguable case’ that a breach has occurred and if so, provide a mediation service.

How long will it take to find out if my complaint is accepted?

All complaints received by OIC are dealt with thoroughly, fairly and as quickly as possible.

In some cases, we can determine whether we can accept your complaint from the information you provide to us.  In other cases, we may need to make preliminary inquiries with you and the agency you are complaining about to find out further information to assist with our decision as to whether or not to accept your complaint.  If we need to contact the respondent agency to make inquiries, we are required to provide them with the details of your complaint.²

Preliminary inquiries may take several weeks to complete, however we will keep you informed about our progress.  Once we have made a decision you will receive a written notice that sets out the reason for our decision.

What happens if my complaint is accepted?

OIC provides a mediation service in privacy complaints.  Once we have accepted a complaint, we take all reasonable steps to assist both parties to resolve the complaint.

The Queensland privacy jurisdiction is remedial in nature. Mediation focuses on the steps that an agency can take to remedy any damage arising out of the privacy breach rather than apportioning blame.  There is no capacity under the IP Act for punitive damages to be awarded.  For example, an agency cannot be fined under the IP Act for breaching an individual’s privacy.

You and the respondent agency will have equal say on the resolution of the complaint, including the opportunity to provide your point of view and to propose options which may resolve the complaint.

What is expected of me?

We will communicate with you with courtesy and respect at all times.  In turn, we request that you communicate with us in the same manner.

We also ask that you participate in good faith in the mediation process, as demonstrated by:

• proposing genuine options for the resolution of your complaint
• being open and honest in your communications; and
• being willing to listen to the agency’s point of view and consider their position.

If you change your address during the complaint process, please let us know as we need to be able to keep you informed about the progress of your complaint.  If we cannot contact you, we may not be able to continue dealing with your complaint.

During the mediation process you may be asked to provide written material to us.  As a matter of fairness, and as appropriate, copies of this material or relevant parts of the material may be provided to the respondent agency.  Please let us know if you provide information in your submission that you do not wish the respondent agency to see.

How will mediation be conducted?

Mediation is an informal process and is voluntary for both parties.

We typically conduct mediation by contacting both parties individually, either by telephone or in writing.  In some instances we may attempt to resolve a complaint by facilitating a meeting between yourself and the respondent agency, either face-to-face or by teleconference.

What outcomes can be achieved through mediation?

A successful resolution requires that the settlement proposal is acceptable to both you and the agency. Ideally, it will go to restoring the working relationship between you and the agency and improve the agency’s systems and practices.

Agreement is commonly reached when both parties are flexible in what they are prepared to both offer and accept in order to resolve the complaint.

When thinking about what outcomes would resolve this complaint for you, you should bear in mind the remedial nature of this jurisdiction. Specifically, you should consider the damage you have suffered as a direct consequence of the alleged privacy breach and what steps the agency is able to take to remedy this damage.

How long will it take to mediate my complaint?

Timeliness is important to us and we aim to finalise complaints within 90 days of a complaint being accepted.  In some cases, it make take longer for OIC to deal with a privacy complaint due to the complexity of the complaint, the time taken to gather information, the duration of discussions about resolution options and the availability of both parties.

What happens if resolution cannot be reached?

If it appears to us that resolution of the complaint is not reasonably likely to be achieved through mediation, you have the option to request that your privacy complaint be referred to the Queensland Civil and Administrative Tribunal (QCAT) for its hearing and determination.  You and the agency will be the parties to the hearing before QCAT, with no further involvement of OIC.

OIC has developed a case note that provides an overview of remedies awarded in Queensland and other privacy jurisdictions, and some of the factors that were given weight by the relevant determinative body when deciding on an appropriate award of compensation.