Regulatory action

Regulatory approach

OVIC's regulatory approach is independent, collaborative, targeted and proportional, transparent and consistent.

Regulatory Action Policy

Our Regulatory Action Policy explains how we use our powers when taking regulatory action.

Witness Welfare Management Policy

This policy describes how OVIC supports the welfare of witnesses and other people involved in OVIC regulatory action.

Regulatory priorities

OVIC’s regulatory priorities focus on significant issues impacting the information rights of Victorians.

Regulatory networks

OVIC participates in national and international regulatory networks to discuss common challenges and priorities.

Investigation into the data breach of student information at the Department of Education

OVIC conducted this investigation into the cyber attack at the Department of Education.

Investigation into the use of surveillance by the University of Melbourne

OVIC conducted this investigation following the tracking of tracking of students involved in a sit-in protest.

Report on the privacy impacts of Greater Western Water’s migration to a new billing and payment system

OVIC conducted this investigation following privacy concerns relating to personal information being disclosed to unauthorised third parties by the new billing and payment system at GWW.

Investigation into the use of ChatGPT by a Child Protection worker

OVIC conducted an investigation in response to a privacy incident reported by the Department of Families, Fairness and Housing regarding a Child Protection worker who had used ChatGPT when drafting a Protection Application Report.

Investigation into Datatime Services Pty Ltd data breach

OVIC conducted an investigation in response to a data breach experienced by Datatime Services Pty Ltd, a contracted service provider to government organisations. The investigation considered Datatime’s information security measures and disposal and retention practices.

Investigation into allegations of surveillance of members of the public by VicForests

OVIC conducted an investigation into VicForests’ surveillance on several members of the public to determine if this surveillance complies with the Privacy and Data Protection Act 2014 (Vic) and Information Privacy Principles 1.1 and 1.2.

Misuse of Department of Health information by third party employees during pandemic response

OVIC conducted an investigation into how the Department of Health managed the access of third-party call centre staff to personal information as the Department responded to the COVID-19 pandemic.

Process versus Outcome: Investigation into VicForests' handling of a series of FOI requests

OVIC conducted an investigation into VicForests' handling of a series of FOI requests to determine if it acted consistently with obligations under the FOI Act.

Investigation into impediments to timely freedom of information

OVIC conducted an own motion investigation into the timeliness of FOI decisions at five Victorian government agencies to identify the factors contributing to delay.

Impediments to timely FOI and information release: twelve months on

This report outlines the progress of agencies in implementing recommendations twelve months on from the own motion investigation.

Investigation into the disclosure of myki travel information

OVIC conducted an investigation into a data breach involving myki users' privacy by Public Transport Victoria and issued a compliance notice.

Investigation into unauthorised access to client information held in the CRISSP database

OVIC conducted an investigation into a data breach involving the former Department of Health and Human Services and issued a compliance notice.

Case study: security and privacy of online forms

This case study outlines the information and security implications of when an agency's online complaint form was not configured and/or tested correctly.

Case Study: Email errors

This case study outlines the experience of a large government organisation which set out to reduce email errors.

Examination into privacy and information handling training at Victoria Police

The objective was to examine whether the training provided to Victoria Police personnel meets the requirements of Information Privacy Principle 4.1.

Examination of Victorian universities' privacy and security policies

OVIC conducted an examination into the protection of personal information in Victorian universities to ensure compliance with the Information Privacy Principles.

Examination into the use of apps and web-based learning tools in Victorian government primary schools

OVIC conducted an examintion into the use of digital learning tools in Victorian government primary schools and how privacy issues are managed.

Examination of Local Government Privacy Policies

OVIC conducted an examination of local government privacy policies to measure compliance with the Information Privacy Principles.

Audit of Standard 10 of the Victorian Protective Data Security Standards

This audit focused on four Victorian public sectororganisations’ adherence to Standard 10 of the Victorian Protective Data Security Standards.

Audit of Standard 2 of the Victorian Protective Data Security Standards

This audit focused on four Victorian public sector organisations' adherence to Standard 2 of the Victorian Protective Data Security Standards.

Audit of Standard 8 of the Victorian Protective Data Security Standards

This audit focused on four Victorian public sector organisations' adherence to Standard 8 of the Victorian Protective Data Security Standards.

2020 - COVID-19 and privacy issues

2019 - Data breach notifications

2018 - Privacy accountability

2017 - User controls over personal information

Review of information governance in the Department of Health and Human Services

This report was published by the Commissioner for Privacy and Data Protection in January 2017.

Review of the Victoria Police Security Incident Management Framework and Practices

This report was published by the Commissioner for Privacy and Data Protection in January 2017.