Published on Office of the Information Commissioner Queensland (https://www.oic.qld.gov.au)

Home Publications  >  Policies  >  Privacy Complaint Handling Policy

Privacy Complaint Handling Policy

1. Overview

This document provides details on the Office of the Information Commissioner (the Office) Privacy Complaints Management System. A complaint is an expression of dissatisfaction about breaches of an individual’s privacy by a government agency.

The Office has a responsibility under Chapter 5 of the Information Privacy Act 2009 to administer privacy complaints made against government agencies. These are referred to in this document as Chapter 5 privacy complaints. The Office can only deal with Chapter 5 privacy complaints which were first made to the agency you believe breached your privacy -this includes the Office.

This document outlines how the Office deals with this kind of complaint: Chapter 5 privacy complaints and initial complaints about the Office’s staff, actions, or service.

Who we are

The Office is an independent statutory body established under the Freedom of Information Act 1992 (Qld) and continued under the Right to Information Act 2009 (Qld) (RTI Act) to promote the principles and practices of Right to Information and Information Privacy and foster improvements in the quality of practice in Right to Information and Information Privacy in Queensland Government agencies.

The Office is responsible for championing the responsible use by government of individual’s personal information and the protection of people’s rights to privacy under the Information Privacy Act 2009 (Qld) (IP Act).

The Office is the primary body for providing information and assistance to Queensland government agencies - state government departments, local councils and universities - Ministers and the community on rights and responsibilities under the IP Act.

2. Bringing your privacy complaint to the Office

2.1 Making a Chapter 5 privacy complaint

Chapter 5 privacy complaints about government agencies

The Office provides a mediation service for Chapter 5 privacy complaints.

Chapter 5 of the IP Act states that before you can bring a privacy complaint to the Office concerning a government agency you must first bring your complaint to the agency and allow it a minimum period of 45 business days to deal with the complaint. If, after this time, you remain dissatisfied with the response you have received from the agency about your privacy complaint, you can bring your complaint to the Office.

If you are unclear about whom you should talk to in an agency about your privacy complaint you can direct your inquiry to the agency’s Right to Information and Privacy Unit. They should be in a position to advise you on the appropriate mechanism for lodging your privacy complaint. In many cases, the Right to Information and Privacy Unit will be the area responsible for dealing with your privacy complaint.

The IP Act requires that Chapter 5 privacy complaints must:

  • be written
  • state an address to which notices can be sent
  • give particulars of the act or practice complained of
  • have been made to the agency at least 45 business days before bringing the Chapter 5 complaint to the Office.

Office staff can assist you to put your complaint in written form.

Office will accept privacy complaints by:

  • e-mail
  • handwritten or typed letter
  • the Office’s online privacy complaints form, either submitted online or provided in hardcopy form.

2.2 What happens then?

Privacy complaints

Chapter 5 privacy complaints are dealt with by the Office’s Privacy Unit. The Privacy Unit will contact you shortly after receipt of your privacy complaint to discuss the progression of the complaint.

Privacy complaints about the Office

If your privacy complaint is an initial privacy complaint about the actions of the Office you must make it following the process outlined above.

If you are not satisfied with the way the Office deals with your initial privacy complaint you can make a formal Chapter 5 privacy complaint to the Office using the above procedure. It will be dealt with by officers who had no involvement in the handling of the initial complaint or the activities which were the subject of the initial complaint. It will be managed in the same way as a complaint about another agency.

3. How we deal with all complaints received by the Office

3.1 Ethical Obligations

Office staff are employed under the Public Service Act 2008 (Queensland). Office staff must comply with the following four ethics principles and related obligations under the Public Service Ethics Act 2004 (Queensland). The principles and obligations form the basis of the Office’s Code of Conduct:

  • integrity and impartiality
  • promoting the public good
  • commitment to the system of Government
  • accountability and transparency.

3.2 Independence

The Office’s performance of its statutory functions is independent of executive government. The Information Commissioner is an officer of the Queensland Parliament, appointed by the Governor in Council under the RTI Act. The Information Commissioner is directly responsible to Queensland Parliament through a Parliamentary Committee and cannot be directed by any person in carrying out functions under the legislation. Office staff can only be directed by the Information Commissioner.

3.3 Privacy

The Office must comply with the privacy principles in the IP Act in its dealings with personal information. This necessarily includes dealing with personal information in the course of administering a complaint.The obligations include the Office:

  • only collecting personal information necessary to the administration of the complaint
  • informing parties to a complaint about the flow of personal information involved in the Office’s administration of the complaint.
  • storing personal information to prevent unauthorised access, use, modification and disclosure
  • taking reasonable steps to ensure the personal information is accurate, complete and up-to-date before use
  • not using personal information obtained in the complaints process for secondary purposes
  • ensuring limited disclosure of personal information obtained in the complaint process to third parties.

3.4 Confidentiality

The Office’s complaint process is strictly confidential. While the Office is obligated to comply with the principles of natural justice/procedural fairness, the exchange of information is limited to that concerning the subject matter of the complaint. Other than the information necessary for the direct management of a complaint, a complainant’s personal information – including the fact that they have lodged a complaint with the Office – will not be disclosed to persons, agencies or bodies outside of relevant Office staff members.

3.5 Policy rationale

It is well-established that settlement discussions conducted in an environment of confidentiality promote frank and candid communications between the parties. In addition, it encourages the parties to propose and consider a wider range of settlement options when they are able to confidently make proposals on a without prejudice basis.

Confidentiality also ensures the integrity of the settlement process. It confirms the status of the mediator as a neutral party whose role is to explore all relevant issues without a concern about being drawn into future legal action between the parties.

The Office adopts Rule 4 of the Conciliation Rules of Australian Institute of Arbitrators and Mediators:

3.6 Rule 4 Confidentiality

1. The Conciliator, the parties and all advisers and representatives of the parties shall:
a) except as provided in paragraph 2 of this Rule, keep all information disclosed during the conciliation process confidential;
b) not use any information disclosed during the conciliation process for any purpose other than the conciliation;
c) if requested by the Conciliator or a party to do so, sign Confidentiality Agreements in the terms of this

Rule.2. The obligation of confidentiality under sub-paragraph a of paragraph 1 above shall apply except:
a) if disclosure is compelled by law;
b) to the extent necessary to give effect to the Agreement, or to enforce an agreement to settle or resolve the whole or any part of the Dispute;
c) where disclosure is only of the occurrence of the conciliation (and not any communication during the conciliation), and the occurrence of the conciliation is relevant to subsequent arbitral, adjudicative or judicial proceedings relating to the Dispute.

While dealing with Chapter 5 privacy complaints, the Office’s policy position is underpinned by the immunity provided in section 153 of the IP Act. It provides that any member of the Office cannot be compelled to produce a ‘privacy document’ and/or disclose ‘privacy information’ in a third party legal proceedings – including, as a matter of course, QCAT proceedings involving a privacy issue.

Chapter 5 privacy complaint material will include:

  • material submitted by the complainant
  • material submitted by the agency; and
  • documents created by the Office for the purpose of administering the privacy complaint.

The Office may make an exception where parties to the Chapter 5 privacy complaint formally request a copy of material they submitted to the Office in the course of the complaint.

3.7 Visibility and Access

Information on how and where to lodge complaints and on the Office’s handling of complaints is available on the Office’s web-site at www.oic.qld.gov.au or available upon request to the Office’s Enquiry Service on (07) 3234 7373.

You can give us feedback at any time by phoning us on (07) 3234 7373 or emailing administration@oic.qld.gov.au.

3.8 Responsiveness

The Office provides the following commitments concerning complaints:

  • will endeavour to acknowledge receipt of a complaint within 5 business days
  • will endeavour to process the complaint in a timely manner
  • will endeavour to finalise all complaints within 90 days of receipt
  • will keep the parties to a complaint informed of the complaint’s progress
  • may make inquiries about the circumstances that are the subject of the complaint.

The complexity of the inquiries and the responsiveness of the inquired parties will determine the progress of the complaint.

3.9 Assessment and Action

The Office will deal with all complaints fairly, professionally and independently.

Chapter 5 privacy complaints are dealt with by a dedicated team within the Office which has expertise in both the fields of privacy and alternative dispute resolution.

For Chapter 5 privacy complaints, the Office is an independent body with expertise in this area and can accordingly provide authoritative information on the application of the privacy principles to government processes. If a resolution is not achievable for a complaint, the Office is obligated under the IP Act to advise the parties to the Chapter 5 privacy complaint of the complainant’s right to progress the complaint to an external body.

3.10 Monitoring Effectiveness

The Office reports on the privacy complaints it deals with in its annual report and to its Parliamentary Oversight Committee.The Office also conducts customer satisfaction surveys of complainants and agencies.

The information obtained through the surveys and from the annual statistics will identify areas of improvement in the way the Office deals with complaints.

The Office reviews the operation of its complaint handling system annually.

3.11 Access and amendment of complaint documents

The RTI Act allows people to access information held by Queensland government agencies; Chapter 3 of the IP Act allows people to access and amend their personal information held by Queensland government agencies. However, these Acts also provide that neither an access nor an amendment application may be made to the Information Commissioner, Privacy Commissioner or RTI Commissioner.

The privacy principles in the IP Act also provide for access to, and amendment of, personal information as follows:

  • IPP 6/NPP 6 – An individual may access documents containing their personal information; and
  • IPP 7/NPP 7 – An individual may amend documents containing their personal information.

While the Office is obligated to comply with the privacy principles, IPP 6(2)(a) and IPP 7(2) permit the Office to refuse to give access to, or amend, a document containing personal information if that document is expressly excluded from the operation of an access or amendment law. Because both the RTI Act and chapter 3 of the IP Act exclude the Office’s Commissioners from their operation, documents of the Office are excluded from the operation of State access and amendment laws.