Privacy in complaints management-status and outcomes

This guideline considers only complaints that are an expression of dissatisfaction about the service or action/inactions of an agency or its employees by a person who is apparently directly affected by the service or action.

This type of complaint is sometimes referred to as a ‘customer complaint’ or, in the context of local government, an ‘administrative action complaint’. For the purposes of this guideline these types of complaints are collectively referred to as an ‘administrative action complaint’.

This guideline does not cover complaints made to an agency about a third party’s alleged non-compliance with legislation administered by the agency. Examples of this type of complaint – sometimes referred to as a ‘regulatory complaint’ – include a report by a member of the public about a child safety concern, suspected unlawful fishing activity, or an illegally parked vehicle. In this context the ‘complainant’ is, from the agency’s perspective, more of an informant and different considerations apply than where the person is complaining about the agency itself.

A regulatory complaint can sometimes bring about an administrative action complaint. For example, an individual complains about an illegally parked vehicle to their local government. Dissatisfied that the driver of the car continues to illegally park their car, the individual makes a further complaint to the local government about its failure to deal properly with their initial complaint. The first complaint is a regulatory complaint, whereas the second is an administrative action complaint.

Administrative action complaints management policy and procedures

An effective administrative action complaints management policy and procedure includes processes for communicating with the complainant on the status/progress of their complaint and on the outcome of the complaint (i.e. actions taken, complaint decision, reasons for the decision and any remedy and review options).1

This guideline will assist agencies to manage the privacy considerations of providing information to a complainant about the status or outcome of their complaint. It is part of a series of resources on privacy in complaints management. See also: Privacy in complaints management - disclosure and natural justice, and Privacy in complaints management - anonymity and confidentiality.

Personal information in complaints

Queensland government agencies have obligations under the Information Privacy Act 2009 (Qld) (IP Act) for the fair collection and handling of personal information. In addition, there are other laws that govern an agency’s dealings with personal information.2

Personal information arising out of a complaint process may include information about the complainant, the employee who may be the subject of the complaint, witnesses and other third party individuals, such as subject matter experts.

The test for whether information is personal information is two-step3. It involves deciding if the information identifies an individual and if the information is about an individual.

Can an individual be identified from the information?

Complaint processes can vary considerably. Some complaint processes provide for a complaint to be made anonymously or ‘allow’ for complaints to be made using a pseudonym.4 Some provide for confidentiality of a complainant’s identity while others adopt a fully open and transparent process where the identity of the complainant is provided to the subject of the complaint5.

In some instances an individual’s identity is clear from the face of the information, for example, the complaint provides an individual’s name, photograph or an identifying description of the individual.6 In some instances an individual’s identity may be ‘reasonably ascertainable’ through contextual information.

Because complaints commonly arise out of specific actions or events, it is often not difficult to work out the identity of the complainant or other third party individuals in those actions or events. For example, in a small agency or in a rural or regional area, information about the business unit or location of the employee who is the subject of the complaint, or even the subject matter of complaint itself, may be sufficient to identify an individual who is a party to the complaint.

Is the information about an individual?

Information is ‘about’ an individual where there is a sufficient link or connection between the information and the individual. This is a contextual issue.7 Information will also be ‘about’ someone if it reveals a fact or opinion about the individual.8

It does not matter if the information is true or false

Information does not need to be true in order to fall within the definition of personal information set out in the IP Act. This means unsubstantiated allegations or statements about an individual are still that individual’s personal information as well as the personal information of the person who made the complaint.

Communicating a complaint’s status and outcome

The requirements in relation to the disclosure of personal information are set out in National Privacy Principle 2 (NPP 2) for health agencies and Information Privacy Principle 11 (IPP 11) for all other agencies.


Unmet expectations are a prime source of frustration and anger for complainants. Letting a complainant know at the beginning of the complaints process as to what the agency can/cannot do, what communication they can expect, who will be involved, the agency’s processes, timelines and possible outcomes can help to ensure a complainant’s expectations are reasonable and realistic.9

Information about the status of a complaint

It should be possible in most circumstances to provide a complainant with information about the status of their complaint without involving the privacy principles.

For example, providing information of a procedural or administrative nature, such as how the agency deals with complaints, where the relevant complaint currently sits within that process, and the potential outcomes of the complaint process discloses no personal information. This could include providing information that demonstrates that the agency is:

  • addressing the context, nature and extent of the complaint
  • assessing the complaint against established criteria
  • determining what complaint issues should be actioned
  • undertaking appropriate investigations, such as conducting a site visit or talking to ‘potential witnesses’ (without identifying who those people are); and/or
  • considering all relevant criteria, such as legislation applicable to the agency and any relevant policies, standards, or directives.

If the complainant knows which employee is dealing with their complaint, a status update will inform them of that employee’s actions to date on the complaint. While this information is the personal information of the employee within the meaning of the IP Act, it is ‘routine personal work information’ as it wholly relates to the employee’s work duties and responsibilities. Disclosure of routine personal work information to a member of the public for a legitimate agency purpose will, in most circumstances, be a permitted disclosure under IPP 11(1)(a) or NPP 2(1)(a).10

Example A – complaint status

Sarah came into the counter area of a department to communicate her dissatisfaction with one of its services. The conversation between Sarah and the employee became animated and Sarah subsequently lodged a complaint about what she considered was the rude and offensive behaviour of the employee. A few weeks after lodging her complaint Sarah asks the department about the status of her complaint.

The department informs Sarah that her complaint is still under investigation and that this involves contacting a number of individuals who witnessed the exchange. The department informs Sarah that it expects to conclude its investigation within a fortnight and that it expects to make a decision on her complaint within a month. It also informs her that if her complaint against the employee is substantiated there is a range of consequences that can occur and provides detail on this range.

Example B – complaint status

Liam complains to his local Council about a barking dog in his neighbourhood (a regulatory complaint). Council askes Liam to keep a diary of when the barking occurs and to return it after 14 days. Liam hears nothing further from Council and the dog barking continues.

Dissatisfied with what he considers to be Council’s inaction, Liam lodges a new complaint to Council about its failure to deal properly with his complaint about his neighbour’s barking dog (an administrative action complaint). Liam contacts Council the following week to find out the status of his complaint.

Council responds that it is reviewing whether the investigating officer complied with Council’s procedures for barking dog complaints. It informs him that these procedures include formally notifying the dog owner that Council has received a complaint about their dog’s barking and provides Liam with a copy of the fact sheet that it includes with its notification letters, which sets out possible causes of barking and potential solutions. Council also informs Liam that it will investigate whether a door-knock was undertaken to collect written statements from neighbours and whether a visit was made to the property where the dog is kept.

Providing a complainant with a status update that includes personal information of third persons arising out of the administration of the complaint, such as the name or a detailed description of witnesses, or the location, date and time of interviews with witnesses, is a potential breach of the IP Act.

When should information be given to a person other than the complainant?

Providing some personal information to the person the subject of the complaint can be a necessary part of the process for some complaints. The rules of natural justice (also known as procedural fairness) require that the person the subject of the complaint be provided with sufficient information to enable them to understand and respond to the complaint made against them. For example, a respondent to a claim of workplace bullying or harassment would not be able to provide a meaningful response to this claim unless the agency informed them of the identity of the alleged victim of their actions.

Natural justice is a common law requirement and, as such, disclosing personal information in order to afford someone natural justice falls within the ‘authorised or required by law’ exception in IPP 11 and NPP 2.11

Information about the outcome of a complaint

Providing information about the outcome of a complaint—such as whether the complaint was substantiated, the reasons for this determination, and the specific measure(s) taken because of the complaint—can reveal personal information about the indiviudal who was the subject of the complaint.

The privacy principles prohibit an agency from disclosing an individual’s personal information to a third party unless one of the permitted exceptions apply. One of the more relevant exceptions for the disclosure of complaint outcome information is where this is ‘required or authorised under a law’.12

An important component of an effective complaints management process is demonstrating to the complainant that their complaint has been taken seriously and that appropriate action was taken in response to their complaint. There will invariably be a set range of outcomes that can apply depending on the subject of the complaint and complainants will want to be assured that the outcome in their complaint is in line with established policy.

Accordingly, in legislative schemes for administrative action complaints it is common for there to be an ‘authorisation’ for the agency to notify the complainant of the outcome reached in their complaint.

However, the forms of this legislative ‘authorisation’ can vary widely. To give three examples:

  • Section 306(3)(d) of the Local Government Regulation 2012 (Qld) requires the local government to inform an affected person of the local government’s decision about the complaint and the reasons for the decision (unless the complaint was made anonymously).
  • Section 219A(2)(b) of the Public Service Act 2008 (Qld) (PS Act) requires agencies to establish and implement a system for managing customer complaints that complies with the current Australian Standard13 about handling customer complaints. The Australian Standard requires complainants to be given ‘reasons’ for the agency’s decision about the complaint.

Furthermore, section 219A(2)(c) of the PS Act states the agency’s complaint handling system must provide for giving notice of the outcome of a customer complaint to the complainant (unless the complaint was made anonymously).

  • Section 57A of the Ombudsman Act 2001 (Qld) states that if the Ombudsman investigates administrative action because of a complaint, the Ombudsman must, as soon as possible inform the complainant, in the way the Ombudsman considers appropriate, of the result of the investigation.

Agencies must comply with their obligation under law to provide notification of the outcome to the complainant. In the absence of a legislative authority specifying what information is to be provided, agencies should strive to achieve a balance between compliance with their legislative obligations, communicating a transparent and accountable complaints process, and ensuring to the greatest practicable extent the privacy of individuals involved in the complaint—and in particular, the subject individual of the complaint.

Good communication is a critical part of effective complaint handling. For example, issuing a detailed outcome letter that addresses:

  • which issues the agency could and could not investigate, and for those it could not investigate the reasons for this
  • for those issues the agency could investigate—whether or not the agency did investigate them; and
  • which issues were substantiated and which were not, including the reasons why those issues were unsubstantiated; and
  • what action(s) the agency took to address them (having due regard to privacy considerations).

can mean that a complainant is more likely to accept an outcome as fair and reasonable, even if it is not what they had hoped for.

An agency employee who is the subject of an administrative action complaint should know their agency’s complaint handling policy and should know that some information about the outcome of the complaint will be provided to the complainant in accordance with that policy. However, they may not necessarily expect that a relatively high level of detail on the outcome would be provided to the complainant.

As such, it might be expected that the agency would advise the complainant that the complaint was substantiated and that the agency took disciplinary action against the employee the subject of the complaint. However, it may not be expected that the agency would provide the complainant with information that the employee was subject to a monetary penalty or the amount of the penalty, or that the employee was dismissed from their employment or transferred to another identified business unit.

Regardless of the fact that it may arise in or out of a work context, the disciplinary action taken against an employee is not routine personal work information and as such cannot be disclosed by relying on IPP 11(1)(a) or NPP 2(1)(a).

Example A – complaint outcome

The department investigated Sarah’s complaint about one of its employee’s conduct by reviewing CCTV footage and interviewing other staff who witnessed the incident. The department determined that the complaint was substantiated and took disciplinary action against the employee.

It advised Sarah that the employee the subject of her complaint did not follow departmental policies and procedures. The department acknowledged the impact of the employee’s behaviour on Sarah and told her it took disciplinary action against the employee. The department again provided Sarah with the range of disciplinary actions that are appropriate in this type of complaint.

When dealing with an administrative action complaint arising out of a regulatory complaint, it is important to bear in mind that the subject of the complaint shifts. The complaint becomes about the actions of the agency, not the actions of the individual that led to the regulatory complaint.

Example B – complaint outcome

Council investigated Liam’s complaint about its handling of his (regulatory) complaint about his neighbour’s barking dog and advised him that the investigating officer acted in accordance with Council’s procedures. It also advised Liam that Council spoke with the dog owner about potential actions to address the barking.

Council provided Liam with the date that the investigating officer undertook a site visit, the number of neighbours who were door-knocked, and the number of written statements it received in response. It also provided Liam with information about permitted animal noise levels and explained how the evidence that Council collected fell within these levels. Council advised Liam that it would conduct a new investigation if it received further complaints and provided him with information about the penalties that it may issue if it was determined that the dog was causing an unreasonable barking nuisance.

It should also be noted that, in all but rare cases, the complainant has no input or right of review of the actual outcome of their complainant. If, for example, the subject employee is subject to a monetary penalty of $1,000 the complainant has no right to argue that this was an insufficient amount.

The complaints process is also intended to bring a sense of closure to an incident. In some instances providing a level of detail of the outcome may act as a trigger to a continuation of the grievance or raise the spectre of a parallel action.


Compliance with a legislative authority that provides for the notification to the complainant about the outcome of their complaints, to the extent of the authorisation, would mean that this notification would not constitute a privacy breach.

For example, if a witness who was interviewed in the course of a complaint process sought information about the outcome, a department could not rely on the ‘authorised or required by law’ exception in IPP 11 and NPP 2 to release personal information related to the outcome of the complaint. This is because the Public Service Act 2008 requires that only the complainant be given notice of the outcome.

  • 1 Queensland Ombudsman’s Policy and procedure guide
  • 2 The IP Act operates subject to the information handling provisions of other Acts. For example, if another law either prohibits or requires the disclosure of particular information, then that law takes precedence over the obligations set out in the IP Act. See sections 4, 5 and 7(2) of the IP Act.
  • 3 Personal information is defined in section 12 of the IP Act as ‘information or an opinion, including information or an opinion forming part of a database, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
  • 4 That is, the complaint process will not require evidence of the complainant’s identity.
  • 5 As an example – the Office of the Information Commissioner’s (OIC) privacy complaint process, by its very nature, requires the identity of the complainant to be provided to the respondent agency.
  • 6 For example – the complaint may be made simply against ‘the Director-General’ of a particular department. This descriptor is sufficient in itself to identify the particular individual.
  • 7 For a more detailed discussion on this issue see Mahoney and Ipswich City Council (310275, 17 June 2011)
  • 8 Refer to OIC’s Privacy Guideline – Key privacy concepts – personal information
  • 9 See Queensland Ombudsman ‘Managing unreasonable complainant conduct’
  • 10 See OIC’s Guideline: Routine personal work information of public sector employees
  • 11 See OIC’s guideline: Privacy in complaints management – disclosure and natural justice
  • 12 IPP 11(1)(d) and NPP 2(1)(f).
  • 13 AS/NZS 10002:2014.

Current as at: June 30, 2017