The Information Privacy Act 2009 (Qld) (IP Act) contains the privacy principles which set out the rules for how personal information is to be collected, managed, used and disclosed by Queensland government agencies.1
When an agency provides information to a complainant about the progress and outcome of their complaint, they must ensure they do so in compliance with the privacy principles. The amount and type of information that can be given to a complainant will often depend on whether they made a customer/administrative action complaint or a regulatory complaint. Both are discussed below under separate headings.
Managing complainant expectations
Complainants may not know, or may make assumptions about, what will happen and what they will be told after they make a complaint. Agencies could consider using the information in this guideline and their own legislation and policies to produce a pamphlet or information sheet which sets out:
- the process the agency follows when it receives a complaint
- how the investigation will be conducted
- the possible outcomes if the investigation finds that a wrongdoing has been committed, and
- to what extent the complainant can expect to be kept informed.
Making it available on the agency's website and giving it to anyone who makes a complaint could go a long way towards ensuring complainants know what to expect from the outset.
Unmet expectations are a prime source of frustration and anger for complainants. Letting a complainant know at the beginning of the complaints process as to what the agency can/cannot do, what communication they can expect, who will be involved, the agency’s processes, timelines and possible outcomes can help to ensure a complainant’s expectations are reasonable and realistic.2
Personal information is any information about an individual who can be identified directly from the information, or whose identity can be reasonably ascertained by reference to other information.3 Complaint processes will generally involve the personal information of the complainant, the individual the subject of the complaint, and witnesses and other third parties, eg subject matter experts.
To determine if information is personal information the agency must decide if the information identifies an individual and if it about that individual.
Can an individual be identified from the information?
Sometimes an individual’s identity is clear from the information itself, for example, the complainant provides an individual’s name, photograph, or an identifying description of the individual.4 However, even where the identity is not obvious from the information, an individual’s identity may still be ‘reasonably ascertainable’ through contextual information.
Complaints generally arise out of specific actions or events, which means the identity of the individuals involved, such as the complainant, witnesses or other third parties, can be readily worked out. For example, in a small agency or in a rural or regional area, information about the business unit, location of the employee the complaint is about, or even the subject matter of complaint, may be enough to identify an individual involved in the complaint.
Is the information about an individual?
Information is ‘about’ an individual where there is a sufficient link or connection between the information and the individual,5 or it reveals a fact or opinion about the individual.6 In almost all cases, complaint information will be about an individual.
It does not matter if the information is true or false
Information does not need to be true to be personal information. This means unsubstantiated allegations or statements about an individual are still that individual’s personal information, as well as the personal information of the person who made the complaint.
Disclosure of personal information
An agency discloses personal information if:
- it tells someone personal information or allows them to find it out
- that person didn't already know it or wasn't in a position to find it out on their own; and
- the agency won't have any control over what happens to the personal information.7
In most cases, if an agency gives personal information to a complainant it will be a disclosure and the privacy principles have rules about disclosing personal information8. Agencies must ensure that, when updating complainants on the progress, or advising them of the outcome, of their complaint, that personal information is not disclosed in breach of the privacy principles.
Customer or administrative action complaints
Customer complaints—or, in the local government context, administrative action complaints—are complaints about the service or action/inactions of an agency or its employees by a person affected by the service or action.
These are not the same as a regulatory complaints, which are complaints about a breach of an Act the agency administers, eg a complaint about a child safety concern, suspected unlawful fishing, or an illegally parked vehicle.
Communicating the status of a customer/administrative action complaint
In most cases, an agency should be able to update a complainant on the status and progress of their customer/administrative action complaint without involving the privacy principles.
Giving the complainant procedural or administrative information, such as how the agency deals with complaints, where the relevant complaint currently sits within that process, and the potential outcomes of the complaint process involves no personal information. Where there is no personal information, an agency does not need to consider the privacy principles.
An agency could provide information that demonstrates they are:
- addressing the context, nature and extent of the complaint
- assessing the complaint against established criteria
- determining what complaint issues should be actioned
- undertaking appropriate investigations, such as conducting a site visit or talking to ‘potential witnesses’ (without identifying who those people are); and/or
- considering all relevant criteria, such as legislation applicable to the agency and any relevant policies, standards, or directives.
Example A: Sarah's complaint – complaint status
Sarah came into the counter area of a department to communicate her dissatisfaction with one of its services. The conversation between Sarah and the employee became animated and Sarah subsequently lodged a complaint about what she considered was the rude and offensive behaviour of the employee. A few weeks after lodging her complaint Sarah asks the department about the status of her complaint.
The department informs Sarah that her complaint is still under investigation and that this involves contacting a number of individuals who witnessed the exchange. The department informs Sarah that it expects to conclude its investigation within a fortnight and that it expects to make a decision on her complaint within a month. It also informs her that if her complaint against the employee is substantiated there is a range of consequences that can occur and provides detail on this range.
Example B: Liam's complaint – complaint status
Liam complains to his local Council about a barking dog in his neighbourhood (a regulatory complaint). Council askes Liam to keep a diary of when the barking occurs and to return it after 14 days. Liam hears nothing further from Council and the dog barking continues.
Dissatisfied with what he considers to be Council’s inaction, Liam lodges a new complaint to Council about its failure to deal properly with his complaint about his neighbour’s barking dog (an administrative action complaint). Liam contacts Council the following week to find out the status of his complaint.
Council responds that it is reviewing whether the investigating officer complied with Council’s procedures for barking dog complaints. It informs him that these procedures include formally notifying the dog owner that Council has received a complaint about their dog’s barking and provides Liam with a copy of the fact sheet that it includes with its notification letters, which sets out possible causes of barking and potential solutions. Council also informs Liam that it will investigate whether a door-knock was undertaken in the neighbourhood and whether the officer visited the property to observe the dog.
Providing a complainant with a status update that includes personal information of third persons arising out of the administration of the complaint, such as the name or a detailed description of witnesses, or the location, date and time of interviews with witnesses, is a potential breach of the IP Act.
Routine personal work information
If the complainant knows which employee is dealing with their complaint, a status update will also give them information about that employee, ie the actions they have taken on the complaint. While this information is the personal information of that employee within the meaning of the IP Act, it is ‘routine personal work information’, because it wholly relates to the employee’s standard work duties and responsibilities. Disclosure of routine personal work information to a member of the public for a legitimate agency purpose will, in most circumstances, be a permitted disclosure under IPP 11(1)(a) or NPP 2(1)(a).9
Communicating the outcome of a customer/administrative action complaint
An important component of an effective customer/administrative action complaints management process is demonstrating to the complainant that:
- their complaint has been taken seriously; and
- appropriate action was taken in response to their complaint.
Depending on the complaint and its severity, a range of outcomes will be possible. Most complainants will want to know that the outcome of their complaint was in line with established policy. However, providing this information—eg whether the complaint was substantiated, the reasons for the decision, and the specific measure(s) taken because of the complaint—can reveal personal information about the individual the complaint was about.
Where an agency is dealing with a customer/administrative action complaint they will be able to give it to the complainant, even though it is personal information, as the legislative schemes that deal with these kinds of complaints generally provide for the complainants to be advised of their complaint's outcome.10
- Section 306(3)(d) of the Local Government Regulation 2012 (Qld) requires the local government to inform an affected person of the local government’s decision about the complaint and the reasons for the decision (unless the complaint was made anonymously).
- Section 219A(2)(b) of the Public Service Act 2008 (Qld) (PS Act) requires agencies to establish and implement a system for managing customer complaints that complies with the current Australian Standard11 about handling customer complaints. The Australian Standard requires complainants to be given ‘reasons’ for the agency’s decision about the complaint.
- Section 219A(2)(c) of the PS Act states the agency’s complaint handling system must provide for giving notice of the outcome of a customer complaint to the complainant (unless the complaint was made anonymously).
- Section 57A of the Ombudsman Act 2001 (Qld) states that if the Ombudsman investigates administrative action because of a complaint, the Ombudsman must, as soon as possible inform the complainant, in the way the Ombudsman considers appropriate, of the result of the investigation.
Compliance with a legislative authority that provides for the complainant to be notified about the outcome of their complaints means the notification, to the extent of the authorisation, is not a privacy breach.
Authorisation is only for the complainant
These legislative authorisations only apply to giving information to the complainant. If a witness who was involved in a complaint process wanted to know the outcome of the complaint, an agency could not rely on one of these provisions to provide them with information.
In the absence of a legislative authority specifying what information is to be provided, agencies should strive to achieve a balance between compliance with their legislative obligations, communicating a transparent and accountable complaints process, and ensuring to the greatest practicable extent the privacy of individuals involved in the complaint—particularly the individual the complaint is about.
Effective outcome letters
Good communication is a critical part of effective complaint handling. For example, issuing a detailed outcome letter that addresses:
- which issues the agency could and could not investigate, and for those it could not investigate the reasons for this
- for those issues the agency could investigate—whether the agency did investigate them; and
- which issues were substantiated and which were not, including the reasons why those issues were unsubstantiated; and
- what action(s) the agency took to address them (having due regard to privacy considerations).
can mean that a complainant is more likely to accept an outcome as fair and reasonable, even if it is not what they had hoped for.
Agency employees should be aware of their agency's policies, including the agency's complaint handling policies. If a complaint is made against an employee, they should know that the complainant will be given some information about the outcome of the complaint. However, they will not necessarily expect significant or detailed information be given to the complainant.
For example, the employee might expect the agency to tell complainant that the complaint was substantiated and that the agency took disciplinary action against the employee. However, they would not expect the agency to tell the complainant that the employee was subject to a monetary penalty or the amount of the penalty, or that the employee was dismissed from their employment or transferred to another identified business unit.
Even though it arose in or out of a work context, the disciplinary action taken against an employee is not routine personal work information and as such cannot be disclosed by relying on IPP 11(1)(a) or NPP 2(1)(a).
Example A: Sarah's complaint – complaint outcome
The department investigated Sarah’s complaint about one of its employee’s conduct by reviewing CCTV footage and interviewing other staff who witnessed the incident. The department determined that the complaint was substantiated and took disciplinary action against the employee.
It advised Sarah that the employee the subject of her complaint did not follow departmental policies and procedures. The department acknowledged the impact of the employee’s behaviour on Sarah and told her it took disciplinary action against the employee. The department again provided Sarah with the range of disciplinary actions that are appropriate in this type of complaint.
When dealing with a customer/administrative action complaint arising out of a regulatory complaint, it is important to bear in mind that the subject of the complaint shifts. The complaint becomes about the actions of the agency or agency employee, not the actions of the individual the regulatory complaint was about.
Example B: Liam's complaint – complaint outcome
Council investigated Liam’s complaint about its handling of his (regulatory) complaint about his neighbour’s barking dog and advised him that the investigating officer acted in accordance with Council’s procedures. It also advised Liam that Council spoke with the dog owner about potential actions to address the barking.
Council provided Liam with the date that the investigating officer undertook a site visit, the number of neighbours who were door-knocked, and the number of written statements it received in response. It also provided Liam with information about permitted animal noise levels and explained how the evidence that Council collected fell within these levels. Council advised Liam that it would conduct a new investigation if it received further complaints and provided him with information about the penalties that it may issue if it was determined that the dog was causing an unreasonable barking nuisance.
It should also be noted that, in all but extremely rare cases, the complainant has no input or right of review about the actual outcome of their complaint. If, for example, the employee they complained about was given a monetary penalty of $1,000, the complainant has no right to argue that this was an insufficient amount.
The complaints process is also intended to bring a sense of closure to the incident that prompted the complaint.
Most agencies have responsibility for conducting investigations into breaches of the law, for example illegal dumping, tree clearing without a permit, or unlawful fishing. Often, the catalyst for these investigations is a complaint from a member of the public. These are called regulatory complaints.
In some circumstances, the complainant will want to know what the agency is doing about their complaint, how the investigation is proceeding, and/or the outcome of the complaint. Unlike customer/administrative action complaints, in most circumstances the complainant has not been directly affected by what they are complaining about.12
When considering whether to give information to the complainant, in addition to the privacy principles agencies will need to consider:
- whether doing so could have a negative impact on the investigation; and
- if there are any confidentiality provisions in their Act that would prevent them from disclosing information about the investigation.
Types of regulatory complaints
The type of regulatory complaint which is made can impact what information the agency can tell the complainant.
- Complaints about an action or an event not linked to a specific individual, eg 'someone has graffitied the public park'. Because the complaint does not identify an individual, information the agency provides to the complainant will not be linkable to anyone. The agency can provide the complainant with information about the investigation and its outcome without involving the privacy principles. Care must still be taken not to disclose information about individuals, eg the identities of the offenders or witnesses.
- Complaints about the actions of companies, eg 'that restaurant has violated the health code' or 'XYZ Inc isn't paying superannuation'. Only individuals have personal information, not companies, so an agency should be able to provide the complainant with some information about the investigation. Care must still be taken not to disclose information about individuals, eg of people who work for or are officers of the company or witnesses.
- Complaints about an individual doing something they think is wrong, eg 'Bob is dumping trash illegally' or 'I saw John setting off fireworks without a permit'. For these complaints, the complainant knows the identity of the individual complained about. Any information the agency gives the complainant about the specifics of the investigation will automatically be linked to the individual being investigated, even if the agency doesn't mention the individual's name.
The approach used for customer/administrative action complaints can be used for these kinds of regulatory complaints. Refer to 'Communicating the status of a customer/administrative action complaint' above for details, but providing procedural or administrative information about how the agency investigates these kinds of alleged breaches of the law, the way the investigations generally progress and possible outcomes depending on the outcome of the investigation, can allow an agency to provide a complainant with information in a way that won’t involve disclosing personal information.
When should information be given to a person other than the complainant?
Providing some personal information to the employee the complaint is about will often be required as part of investigating some complaints. The rules of natural justice (also known as procedural fairness) require that the person the subject of the complaint be provided with enough information to enable them to understand and respond to the complaint made against them.
For example, someone who has had a complaint of workplace bullying or harassment made against them would generally not be able to provide a meaningful response to this claim unless the agency identified the alleged victim of their actions.
Where giving someone natural justice requires disclosing personal information, the disclosure will be authorised by law. Refer to Natural justice, disclosure, and privacy for more information.
- 1 In this Guideline references to an ‘agency’ include Ministers and bound contracted service providers, unless otherwise specified.
- 2 See Queensland Ombudsman ‘Managing unreasonable complainant conduct’, accessible at https://www.ombudsman.qld.gov.au/improve-public-administration/public-admin-resources/managing-unreasonable-complainant-conduct.
- 3 Section 12 of the IP Act. Refer to What is Personal information for more information.
- 4 For example – the complaint may be made simply against ‘the Director-General’ of a particular department. This descriptor is sufficient in itself to identify the particular individual.
- 5 For a more detailed discussion on this issue see Mahoney and Ipswich City Council (310275, 17 June 2011)
- 6 Refer to OIC’s Privacy Guideline – Key privacy concepts – personal information
- 7 As defined in section 23 of the IP Act. Agencies should refer to the Disclosure Checklist for help determining if giving personal information to a third party is a disclosure.
- 8 National Privacy Principle 2 for health agencies; Information Privacy Principle 11 for other agencies.
- 9 See OIC’s Guideline: Routine personal work information of public sector employees
- 10 The privacy principles prohibit an agency from disclosing an individual’s personal information to a third party unless one of the permitted exceptions apply. One of exceptions is where the disclosure of personal information s authorised or required by or under a law - IPP 11(1)(d) and NPP 2(1)(f).
- 11 AS/NZS 10002:2014.
- 12 There are exceptions, and where the complainant is directly affected agencies may need to take that into consideration when considering the extent to which they update the complainant.
Current as at: September 20, 2019