The Information Privacy Act 2009 (Qld) (IP Act) contains the privacy principles which set out the rules for how personal information is to be collected, managed, used and disclosed by Queensland government agencies.¹

When an agency provides information to a complainant about the progress and outcome of their complaint, they must ensure they do so in compliance with the privacy principles. The amount and type of information that can be given to a complainant will often depend on whether they made a customer/administrative action complaint or a regulatory complaint. Both are discussed below under separate headings.

Managing complainant expectations

Complainants may not know, or may make assumptions about, what will happen and what they will be told after they make a complaint. Agencies could consider using the information in this guideline and their own legislation and policies to produce a pamphlet or information sheet which sets out:

• the process the agency follows when it receives a complaint
• how the investigation will be conducted
• the possible outcomes if the investigation finds that a wrongdoing has been committed, and
• to what extent the complainant can expect to be kept informed.

Making it available on the agency's website and giving it to anyone who makes a complaint could go a long way towards ensuring complainants know what to expect from the outset.

Personal information

Personal information is any information about an individual who can be identified directly from the information, or whose identity can be reasonably ascertained by reference to other information.³ Complaint processes will generally involve the personal information of the complainant, the individual the subject of the complaint, and witnesses and other third parties, eg subject matter experts.

To determine if information is personal information the agency must decide if the information identifies an individual and if it about that individual.

Can an individual be identified from the information?

Sometimes an individual’s identity is clear from the information itself, for example, the complainant provides an individual’s name, photograph, or an identifying description of the individual.⁴ However, even where the identity is not obvious from the information, an individual’s identity may still be ‘reasonably ascertainable’ through contextual information.

Complaints generally arise out of specific actions or events, which means the identity of the individuals involved, such as the complainant, witnesses or other third parties, can be readily worked out. For example, in a small agency or in a rural or regional area, information about the business unit, location of the employee the complaint is about, or even the subject matter of complaint, may be enough to identify an individual involved in the complaint.

Is the information about an individual?

Information is ‘about’ an individual where there is a sufficient link or connection between the information and the individual,⁵ or it reveals a fact or opinion about the individual.⁶ In almost all cases, complaint information will be about an individual.

Disclosure of personal information

An agency discloses personal information if:

• it tells someone personal information or allows them to find it out
• that person didn't already know it or wasn't in a position to find it out on their own; and
• the agency won't have any control over what happens to the personal information.⁷

In most cases, if an agency gives personal information to a complainant it will be a disclosure and the privacy principles have rules about disclosing personal information⁸. Agencies must ensure that, when updating complainants on the progress, or advising them of the outcome, of their complaint, that personal information is not disclosed in breach of the privacy principles.

Customer or administrative action complaints

Customer complaints—or, in the local government context, administrative action complaints—are complaints about the service or action/inactions of an agency or its employees by a person affected by the service or action.

These are not the same as a regulatory complaints, which are complaints about a breach of an Act the agency administers, eg a complaint about a child safety concern, suspected unlawful fishing, or an illegally parked vehicle.

Communicating the status of a customer/administrative action complaint

In most cases, an agency should be able to update a complainant on the status and progress of their customer/administrative action complaint without involving the privacy principles.

Giving the complainant procedural or administrative information, such as how the agency deals with complaints, where the relevant complaint currently sits within that process, and the potential outcomes of the complaint process involves no personal information. Where there is no personal information, an agency does not need to consider the privacy principles.

An agency could provide information that demonstrates they are:

• addressing the context, nature and extent of the complaint
• assessing the complaint against established criteria
• determining what complaint issues should be actioned
• undertaking appropriate investigations, such as conducting a site visit or talking to ‘potential witnesses’ (without identifying who those people are); and/or
• considering all relevant criteria, such as legislation applicable to the agency and any relevant policies, standards, or directives.

Providing a complainant with a status update that includes personal information of third persons arising out of the administration of the complaint, such as the name or a detailed description of witnesses, or the location, date and time of interviews with witnesses, is a potential breach of the IP Act.

Communicating the outcome of a customer/administrative action complaint

An important component of an effective customer/administrative action complaints management process is demonstrating to the complainant that:

• their complaint has been taken seriously; and
• appropriate action was taken in response to their complaint.

Depending on the complaint and its severity, a range of outcomes will be possible. Most complainants will want to know that the outcome of their complaint was in line with established policy. However, providing this information—eg whether the complaint was substantiated, the reasons for the decision, and the specific measure(s) taken because of the complaint—can reveal personal information about the individual the complaint was about.

Where an agency is dealing with a customer/administrative action complaint they will be able to give it to the complainant, even though it is personal information, as the legislative schemes that deal with these kinds of complaints generally provide for the complainants to be advised of their complaint's outcome.¹⁰

Compliance with a legislative authority that provides for the complainant to be notified about the outcome of their complaints means the notification, to the extent of the authorisation, is not a privacy breach.

In the absence of a legislative authority specifying what information is to be provided, agencies should strive to achieve a balance between compliance with their legislative obligations, communicating a transparent and accountable complaints process, and ensuring to the greatest practicable extent the privacy of individuals involved in the complaint—particularly the individual the complaint is about.

Agency employees should be aware of their agency's policies, including the agency's complaint handling policies. If a complaint is made against an employee, they should know that the complainant will be given some information about the outcome of the complaint. However, they will not necessarily expect significant or detailed information be given to the complainant.

For example, the employee might expect the agency to tell complainant that the complaint was substantiated and that the agency took disciplinary action against the employee. However, they would not expect the agency to tell the complainant that the employee was subject to a monetary penalty or the amount of the penalty, or that the employee was dismissed from their employment or transferred to another identified business unit.

Even though it arose in or out of a work context, the disciplinary action taken against an employee is not routine personal work information and as such cannot be disclosed by relying on IPP 11(1)(a) or NPP 2(1)(a).

When dealing with a customer/administrative action complaint arising out of a regulatory complaint, it is important to bear in mind that the subject of the complaint shifts. The complaint becomes about the actions of the agency or agency employee, not the actions of the individual the regulatory complaint was about.

It should also be noted that, in all but extremely rare cases, the complainant has no input or right of review about the actual outcome of their complaint. If, for example, the employee they complained about was given a monetary penalty of $1,000, the complainant has no right to argue that this was an insufficient amount.

The complaints process is also intended to bring a sense of closure to the incident that prompted the complaint.

Regulatory complaints

Most agencies have responsibility for conducting investigations into breaches of the law, for example illegal dumping, tree clearing without a permit, or unlawful fishing. Often, the catalyst for these investigations is a complaint from a member of the public. These are called regulatory complaints.

In some circumstances, the complainant will want to know what the agency is doing about their complaint, how the investigation is proceeding, and/or the outcome of the complaint. Unlike customer/administrative action complaints, in most circumstances the complainant has not been directly affected by what they are complaining about.¹²

When considering whether to give information to the complainant, in addition to the privacy principles agencies will need to consider:

• whether doing so could have a negative impact on the investigation; and
• if there are any confidentiality provisions in their Act that would prevent them from disclosing information about the investigation.

Types of regulatory complaints

The type of regulatory complaint which is made can impact what information the agency can tell the complainant.

• Complaints about an action or an event not linked to a specific individual, eg 'someone has graffitied the public park'. Because the complaint does not identify an individual, information the agency provides to the complainant will not be linkable to anyone. The agency can provide the complainant with information about the investigation and its outcome without involving the privacy principles. Care must still be taken not to disclose information about individuals, eg the identities of the offenders or witnesses.

• Complaints about the actions of companies, eg 'that restaurant has violated the health code' or 'XYZ Inc isn't paying superannuation'. Only individuals have personal information, not companies, so an agency should be able to provide the complainant with some information about the investigation. Care must still be taken not to disclose information about individuals, eg of people who work for or are officers of the company or witnesses.

• Complaints about an individual doing something they think is wrong, eg 'Bob is dumping trash illegally' or 'I saw John setting off fireworks without a permit'. For these complaints, the complainant knows the identity of the individual complained about. Any information the agency gives the complainant about the specifics of the investigation will automatically be linked to the individual being investigated, even if the agency doesn't mention the individual's name.

The approach used for customer/administrative action complaints can be used for these kinds of regulatory complaints.  Refer to 'Communicating the status of a customer/administrative action complaint' above for details, but providing procedural or administrative information about how the agency investigates these kinds of alleged breaches of the law, the way the investigations generally progress and possible outcomes depending on the outcome of the investigation, can allow an agency to provide a complainant with information in a way that won’t involve disclosing personal information.

When should information be given to a person other than the complainant?

Providing some personal information to the employee the complaint is about will often be required as part of investigating some complaints. The rules of natural justice (also known as procedural fairness) require that the person the subject of the complaint be provided with enough information to enable them to understand and respond to the complaint made against them.

For example, someone who has had a complaint of workplace bullying or harassment made against them would generally not be able to provide a meaningful response to this claim unless the agency identified the alleged victim of their actions.

Where giving someone natural justice requires disclosing personal information, the disclosure will be authorised by law. Refer to Natural justice, disclosure, and privacy for more information.