Complaint status and outcomes - what can you tell complainants?

Overview

The Information Privacy Act 2009 (Qld) (IP Act) contains the Queensland Privacy Principles (QPPs) which set the rules for how Queensland government agencies¹ deal with personal information.

Every agency receives and manages complaints, and must comply with the QPPs when informing a complainant about the progress and outcome of their complaint. How the QPPs apply can depend on whether the complaint is a customer/ administrative action complaint or a regulatory complaint.

Managing complainant expectations

Complainants may not know, or may make assumptions about, what will happen and what they will be told after they make a complaint. Agencies can use the information in this guideline and their own legislation and policies to produce a pamphlet or information sheet and include a statement on their website which explains:

• the process the agency follows when it receives a complaint
• how the investigation will be conducted
• the possible outcomes if the investigation finds that a wrongdoing has been committed, and
• to what extent the complainant can expect to be kept informed.

Unmet expectations are a prime source of frustration and anger for complainants. Letting a complainant know at the beginning of the complaints process as to what the agency can/cannot do, what communication they can expect, who will be involved, the agency’s processes, timelines and possible outcomes can help to ensure a complainant’s expectations are reasonable and realistic.²

What is personal information?

The QPPs apply to the collection, management, security, use and disclosure of personal information. Personal information is any information about an identified individual or who is reasonably identifiable from the information.³ Complaint processes will generally involve personal information.

Sometimes an individual’s identity is clear from the information itself, for example, it includes their name or an identifying description. However, even where the identity is not obvious from the information, an individual may be reasonably identifiable from the context or other reasonably available information.

Complaints generally arise out of specific actions or events, which means the identity of the individuals involved, such as the complainant, witnesses or other third parties, can be readily worked out. For example, in a small agency or in a rural or regional area, information about the business unit, location of the employee the complaint is about, or even the subject matter of complaint, may be enough to identify an individual involved in the complaint.

For more information refer to Key privacy concepts – personal and sensitive information.

Disclosing personal information to the complainant

If an agency gives personal information to a complainant that the complainant does not already know or cannot find out for themselves, it will generally be a disclosure. Under QPP 6, agencies can only disclose personal information for the purpose the information was collected or for the permissible secondary purposes set out in QPP 6.2.

When informing complainants of the progress or outcome of their complaint, agencies must ensure that they do not disclose personal information in breach of QPP 6.

Refer to Key privacy concepts – use and disclosure and the QPP 6 guidelines for more information.

Types  of complaints

Complaints can generally be categorised as customer or, for local government, administrative action complaints or regulatory complaints.

Customer or administrative action complaints are complaints about the service, actions, or failures of an agency or its employees made by a person affected by the service or action.

Regulatory complaints are complaints about a breach of an Act the agency administers, e.g., a complaint about a child safety concern, suspected unlawful fishing, or an illegally parked vehicle.

Customer or administrative action complaints

Status updates

In most cases, an agency should be able to update a complainant on the status and progress of their customer/administrative action complaint without disclosing personal information and therefore involving the QPPs.

Giving the complainant procedural or administrative information, such as how the agency deals with complaints, where the relevant complaint currently sits within that process, and the potential outcomes of the complaint process should ordinarily involve no personal information. Where there is no personal information, an agency does not need to consider the QPPs.

An agency could provide information that demonstrates they are:

• addressing the context, nature, and extent of the complaint
• assessing the complaint against established criteria
• determining what complaint issues should be actioned
• undertaking appropriate investigations, such as conducting a site visit or talking to ‘potential witnesses’ (without identifying who those people are); and/or
• considering all relevant criteria, such as legislation applicable to the agency and any relevant policies, standards, or directives.

On the other hand, providing a complainant with a status update that includes personal information of other people arising out of the administration of the complaint, such as names or a detailed description of witnesses, or the location, date, and time of interviews with witnesses, may potentially breach of the IP Act.

Outcome of the complaint

An important component of an effective customer/administrative action complaints management process is demonstrating to the complainant that:

• their complaint has been taken seriously; and
• appropriate action was taken in response to their complaint.

Depending on the complaint and its severity, a range of outcomes will be possible. Most complainants will want to know that the outcome of their complaint was in line with established policy. However, providing this information, e.g., whether the complaint was substantiated, the reasons for the decision, and the specific measure(s) taken because of the complaint, can disclose personal information about the individual the complaint was about.

Where an agency is dealing with a customer/administrative action complaint they may be able to disclose this personal information to the complainant if:

• the legislative schemes governing the complaint process provides for complainants to be advised of their complaint's outcome, under QPP 6.2(b); or
• disclosure for this purpose was one of the reasons the personal information was collected, under QPP 6.1; or
• disclosure for this purpose is related to the reason it was collected and the individual would reasonably expect it to be disclosed for this purpose, under QPP 6.2(a).

Agencies should ensure that their employees are aware of their agency's complaint management policies, including the agency's policies about informing complainants of the outcome of their complaint.

If a complaint is made against an employee, the employee should know that the complainant will be given a reasonable amount of information about the outcome of the complaint. This will allow an agency to rely on QPP 6 to disclose the information because the disclosure is either one of the purposes for which the information was collected or a directly related and expected purpose. This would generally not extend to significant, detailed, or highly private information.

Regulatory complaints

Many agencies have responsibility for conducting investigations into breaches of the law, for example illegal dumping, tree clearing without a permit, or unlawful fishing. Agencies are often advised of these breaches by members of the public. These are called regulatory complaints.

In some circumstances, the complainant will want to know what the agency is doing about their complaint, how the investigation is proceeding, and/or the outcome of the complaint. Unlike customer/administrative action complaints, in the complainant may not have been directly affected by what they are complaining about.

When deciding whether to give information about the investigation to the complainant, the agency must consider:

• the QPPs
• whether doing so could have a negative impact on the investigation; and
• any confidentiality or secrecy provisions in the agency’s own Act.

Types of regulatory complaints

The involvement and knowledge of the complainant in the regulatory complaint will impact the information the agency can tell the complainant.

For complaints about an action or an event not linked to a specific individual, e.g., 'someone has graffitied the public park', The agency can provide the complainant with information about the investigation and non-personal information about its outcome, e.g. we found the person responsible and fined them, without involving the QPPs. Care must still be taken not to disclose information about individuals, e.g. the identities of the offenders or witnesses.

If the complaint is about a company, e.g., 'that restaurant violated the health code' or 'XYZ Inc isn't paying superannuation', An agency should be able to provide the complainant with some information about the status and outcome of the investigation because companies do not have personal information. Care must be taken not to disclose information about individuals, e.g., company staff or witnesses, or who can be reasonably identified from company information.

Complaints that name an individual, e.g., 'Bob is dumping trash illegally' or 'I saw John setting off fireworks without a permit' limit the information an agency can share with the complainant. Because the complainant knows the identity of the alleged offender, any information the agency gives them will automatically be linked to the individual, even if the agency doesn't mention the individual's name.

The approach used for customer/administrative action complaints may be useful for these kinds of regulatory complaints, e.g. providing procedural or administrative information about how the agency investigates alleged breaches of the law, the way the investigations generally progress and possible outcomes depending on the outcome of the investigation.