Privacy Complaints at OVIC – Guide for Respondents
Introduction
Victorian public sector organisations (including Victorian government departments, local councils, statutory offices, government schools, universities and TAFEs) must comply with the Privacy and Data Protection Act 2014 (PDP Act). The PDP Act also applies to some private or community sector organisations who are carrying out functions for or on behalf of a Victorian public sector organisation. The PDP Act contains ten Information Privacy Principles (IPPs) that govern the collection, management, use and disclosure of personal information, and gives individuals a right to complain if they think that an organisation has breached one of the IPPs.
When an individual believes their privacy has been breached, we advise them to raise the matter with the organisation involved (i.e. you, the respondent) in the first instance. If you are unable to resolve the complaint, that person may bring their complaint to us.
Our job is to try to resolve complaints by conciliation. That means we don’t take sides, we don’t decide who is right or wrong, and we don’t determine whether an individual’s privacy has or has not been breached. As conciliators, our job is to help your organisation engage with the complainant, talk through the issues and resolve the complaint in a way that is acceptable to everyone, and which upholds the objectives of the PDP Act.
If we cannot resolve a complaint though conciliation, the individual may request for their complaint to be referred to the Victorian Civil and Administrative Tribunal (VCAT).
Key points
The focus of our complaint process is on conciliating complaints about possible breaches of the IPPs.
It is not our role to investigate complaints or decide if your agency has breached the IPPs.
If a complaint is not resolved, complainants may take their complaint to VCAT. Our complaint process provides an opportunity to resolve privacy complaints by agreement.
When can a privacy complaint be made?
The PDP Act gives individuals a right to complain about breaches of the IPPs. If the complainant has not already done so, we will generally refer them to the Privacy Officer of the respondent organisation to try and resolve the complaint. This gives organisations an opportunity to resolve complaints quickly and efficiently, before they have a chance to escalate. If the complainant does not receive a response in approximately 30 days, or is not satisfied with the respondent’s response then they are encouraged to bring their complaint to us.
Resolving complaints before they escalate
In general, complaints get harder to manage the longer they stay open. This can be because complainants become frustrated with delays, their expectations of a significant outcome increase, or they can start to raise new issues. Conversely, well-handled complaints offer real benefits — each complaint is an opportunity to build or restore public trust and improve services and outcomes for individuals.
Because of this, it is important that organisations have effective internal complaint handling procedures and respond promptly to complaints. The Victorian Ombudsman has produced a Good Practice Guide to Complaint Handling for Victorian Public Sector Agencies, which outlines the guiding principles and practical steps involved in the three key stages of good complaint handling.
What happens when someone makes a complaint?
Our role
Our main function is to try and help your organisation and the complainant resolve matters through conciliation. Conciliation is a common approach to dispute resolution that is focused on finding ways to resolve disputes, rather than assigning blame or determining fault.
As conciliators, our staff remain independent. We do not take sides, and we do not represent either party. Our job is to help you and the complainant talk through the issues and resolve the complaint in a way that is acceptable to everyone.
Our complaints process
When we receive a complaint, we conduct an initial review to confirm that we have all the information we need and that it’s within our jurisdiction to consider. If a complaint falls outside of our jurisdiction, we’ll usually refer it to the appropriate body. If a complaint is incomplete or unclear, we will usually assist the complainant to refine it. At this stage, we may also contact your organisation to ask questions or to explore options for early resolution of the complaint.
After our initial review, we will formally notify your organisation by sending through a copy of the complaint (or a summary of the complaint if one has been prepared by our staff). If we haven’t already, we’ll ask you to contact us to have a preliminary discussion about the complaint. We’ll want to hear your initial assessment of the complaint and your views on the outcomes sought, as well as whether you can see any practical options for moving the matter towards resolution.
Depending on the type and seriousness of the complaint, we might ask you for written submissions in relation to the complaint, including whether we should decline to entertain the complaint, or whether conciliation is appropriate in the circumstances.
If it is appropriate in the circumstances, we will try to conciliate. Conciliation may be conducted indirectly (where the parties communicate with each other through the our Conciliator), over the phone or at a face to face meeting. The Conciliator will decide on the best approach to conciliation in each case.
In some cases, we might decline to entertain the complaint. For example, if we think that the act or practice complained about does not breach the IPPs, or if we think that the organisation has already dealt adequately with your complaint.
If we think conciliation is inappropriate or has failed, or if we decline to entertain the complaint, we will notify both parties. If this happens, the complainant can have the complaint referred to VCAT.
What is conciliation?
Conciliation is a form of alternative dispute resolution, similar to mediation. Conciliation processes can look quite different in different contexts, but they usually involve an independent person with expert knowledge (the conciliator) helping the parties to identify and agree on a fair resolution of their dispute. The conciliator cannot adjudicate or otherwise determine the outcome of your dispute. However, if required, a conciliator may use their expert knowledge of the legislative context and apply the relevant provisions of the law to challenge positions or raise relevant issues for consideration. That means a conciliator might talk to the parties about the reasonableness of their demands and arguments, or provide an opinion on other matters, such as the prospects of the complaint succeeding at VCAT.
Conciliation is voluntary and facilitated by a staff member acting as the conciliator. One of the many advantages of conciliation is that it is significantly less demanding than arguing a case before VCAT. Conciliation is also confidential — any evidence of things said or done in conciliation is not admissible before the tribunal or other legal proceedings, unless you and the complainant.
What happens if conciliation is inappropriate?
While it’s a very effective tool for dispute resolution, not every complaint can be resolved through conciliation. This might be because:
- the parties views of the facts and/or acceptable options for resolving the matter are so different that it’s unlikely that we can find any common ground,
- the relationship between the parties has deteriorated so much that talking is unlikely to help, or
- either party refuses to participate in conciliation (conciliation is voluntary, and relies on consent and collaboration to be effective).
If it doesn’t look like we will be able to resolve a complaint through conciliation, we will close the complaint and the complainant will have an opportunity to have the matter referred to VCAT for hearing.
What happens if conciliation is unsuccessful?
If an agreement cannot be reached through conciliation, the Commissioner will write to the parties to tell them that conciliation has failed. If this happens, we will close the complaint and you will have an opportunity to have the matter referred to VCAT for hearing.
Can the Commissioner decline to entertain a complaint?
Yes. The Commissioner may decline to entertain some complaints, for example, where it doesn’t appear that the act or practice complained about amounts to an interference with privacy, or where the Commissioner considers that the organisation has already responded adequately. The Commissioner may also decline to entertain a complaint if:
- the complainant didn’t complain to the organisation and give them time to respond before complaining the Commissioner;
- the matter has been dealt with under another Act, or another Act provides a more appropriate remedy; or
- the complaint is frivolous, vexatious, misconceived or lacking in substance.
It is important to remember, however, that declining to entertain a complaint may not make it go away. When the Commissioner declines to entertain a complaint, the complainant still has the right to have their matter referred to VCAT. Because of this, it is sometimes productive to try to resolve a complaint through conciliation, even when there may be grounds to decline to entertain it.
What happens if the complaint can’t be resolved?
If we cant resolve the complaint
If we don’t think that we can resolve a complaint, we will write to both parties to explain why. This might be because we decline to entertain the complaint for one of the reasons outlined above, or it might be because we have decided that conciliation is inappropriate or has failed.
If we can’t resolve a complaint, the complainant may choose:
- to have the matter referred to VCAT for hearing and determination, or
- not to pursue the matter further, or to pursue it through some other legal or political mechanism, rather than as a privacy complaint under the PDP Act.
Referral to the Victorian Civil and Administrative Tribunal
Complainants wishing to have their complaint referred to VCAT must notify us in writing within 60 days of receiving notice that we cannot resolve the complaint. The Commissioner has no power to extend the 60 day period.
VCAT will hear evidence from both parties and can make an enforceable determination about a complaint. If VCAT is satisfied that on the balance of probabilities, your organisation did interfere with the complainant’s privacy, it can order your organisation to pay compensation or to take certain specified actions. You can find more information about the handling of privacy complaints by VCAT in our guide to the handling of complaints under the Privacy and Data Protection Act 2014 by the Victorian Civil and Administrative Tribunal.
Dismissing a complaint
If a complaint is not referred to VCAT, it will be dismissed. A complainant may take no further action under the PDP Act in relation to the subject matter of a complaint that is dismissed by the Commissioner. This means that the complainant cannot later make a fresh privacy complaint about the same act or practice (though they may make applications or complaints under other laws).
