Complaints made to Privacy NSW
Complaints to Privacy NSW can only be about a breach of privacy.
Types of complaints
The main types of privacy complaints we deal with are:
Except in special circumstances, we will not accept complaints that are:
because they should generally be dealt with as an internal review by the agency. (See the definition of special circumstances).
What we do about complaints
If we accept a complaint and believe that there has been a breach of the person's privacy, we will try to conciliate an outcome (for example, by asking the organisation responsible to apologise). See more below about the processes we follow.
Limits on making a complaint
We ask people wishing to make formal complaints to do so in writing. Where necessary, staff can arrange for translator and interpreter services or provide other forms of assistance for complainants with communication difficulties.
Complaints should be sent to us within 6 months of the complainant first becoming aware of the conduct or decision they are complaining about. A longer time period may be granted in some circumstances. (More information about our policy on time limits).
How does Privacy NSW deal with complaints?
When a formal written complaint is received, we may conduct a preliminary assessment. We may need to ask the complainant for more details. Once we decide to deal with a complaint, the person or organisation complained about (the respondent) is given details of the complaint and asked to comment on the alleged facts and privacy issues. Many complaints are resolved at this stage either by explaining the reasons for the action to the complainant or by making the respondent aware of the effect of his or her actions.
If a complaint cannot be resolved by negotiation between the parties, we may prepare a report containing our findings and recommendations regarding the dispute. If our recommendations are not accepted, the Commissioner may exercise their discretion to prepare a special report to Parliament. This power is only exercised rarely.
How does Privacy NSW determine if there has been a breach of privacy?
Privacy NSW’s job is to determine whether or not there has been a “violation or interference with” a person’s privacy. Another phrase for this is a “breach of privacy”.
If there are privacy principles set by law that apply to a particular complaint, Privacy NSW will assess whether or not the respondent has complied with those privacy principles.
If we find that the privacy principles set by law have not been complied with, without lawful excuse, we can determine that there has been a breach of the complainant's privacy. More>>
How long will it take?
The investigation of a complaint may involve just a few phone calls or it may take several months, depending on its complexity and the willingness of parties to cooperate. We aim to acknowledge all written complaints within five working days of receipt and, if a complaint is likely to take some months to resolve, we will provide regular progress reports.
What if Privacy NSW is not the best organisation to handle my complaint?
If Privacy NSW feels that we are not the best organisation to deal with a complaint, and if the complainant gives us their express consent, we will pass the complaint on to a more appropriate government agency.
To facilitate this, Privacy NSW has entered into an Information Sharing Arrangement and a Complaint Referral Arrangement with the NSW Ombudsman, the Health Care Complaints Commissioner, the Anti-Discrimination Board and the Legal Services Commissioner. These Arrangements enable the signatory agencies to refer a complaint to another agency if that agency has the powers to deal with it. For more information you can read the Information Sharing and Complaint Referral Arrangements.
Otherwise, we may simply suggest that the complainant approach a more appropriate organisation for assistance.
A number of other organisations deal with complaints involving privacy issues:
- Office of the Federal Privacy Commissioner – deals with complaints about private health service providers, large businesses, federal government agencies, tax file numbers, consumer credit reporting and federal spent convictions, phone 1300 363 992
- Health Care Complaints Commission - deals with complaints about confidentiality of medical records and conduct of health workers in New South Wales, phone (02) 9219 7444
- NSW Ombudsman - deals with complaints against NSW government agencies, including NSW Police, Department of Community Services and the Department of Ageing Disability and Home Care, phone (02) 9286 1000
- Telecommunications Industry Ombudsman - deals with complaints about telephone carriers and service providers, phone 1800 062 058
- Australian Direct Marketing Association - can assist in removing names from mailing lists, phone 1800 252 389
Where can I find out more?
You can read Privacy NSW’s Protocol for the Handling of Complaints which explains what we do in more detail.
Can a complaint be anonymous?
Yes. However sometimes the respondent may be unable to respond to a complaint without knowing the complainant's identity. An anonymous complaint may therefore have a low chance of being resolved. There is also a risk that the respondent may guess the complainant's identity from the substance of their complaint.
Enforcement of our decision
Our findings and recommendations are not binding. That means we do not have the power to order an organisation to do anything. In exceptional circumstances, the Commissioner can make a special report to Parliament on the findings of an investigation.
However from 1 September 2004, complaints made to the Privacy Commissioner about the use of health information will become enforceable by the Administrative Decisions Tribunal.
How are complaints about health information dealt with?
From September 2004 the Health Records & Information Privacy Act 2002 (HRIP Act) gives new and special protection to health information.
Both public sector agencies and private sector persons or organisations must comply with the 15 HPPs. There are also special rules for private sector persons or organisations on keeping and giving access to health information. See here for more information about the HRIP Act.
So from September 2004, complaints about the privacy of health information will be treated a little differently. The process followed will partly depend on who the complaint is about.
If a complaint is against a NSW public sector agency, it should generally be dealt with as an internal review by the agency. After the internal review, the complainant can take their complaint to the Administrative Decisions Tribunal if they want an enforceable decision. See here for more about this process.
If the complaint is against a private sector person or organisation, the complainant should lodge the complaint with Privacy NSW.
If we deem it appropriate, and if both parties agree, we will endeavour to resolve the matter by conciliation. Choosing conciliation as the option for a complaint means the matter ends with the conciliation process.
Alternatively we can investigate the matter further, and then issue a written report to both parties, stating our findings and recommendations. Our report is not binding, and so it is up to both parties to decide whether or not they are going to follow any of our recommendations. If the complainant is still not satisfied after this process, they can ask the Administrative Decisions Tribunal (the Tribunal) to conduct a review of their complaint. The complainant should ask the Tribunal to do this within 28 days of receiving the written report from Privacy NSW (or a later date if our report sets a later date). The Tribunal may order the respondent to change its practices, apologise, or take some steps to remedy any damage suffered by the complainant. Click here for more information about privacy cases in the Tribunal.
|
|
