Any person who wishes to make a complaint to the Board about an alleged breach of any of the Information Privacy Principles (‘IPPs’) must do so in writing in accordance with the provisions of the IPA and specifically section 166 of the IPA. Complaints should be addressed to the attention of the Privacy Contact Officer but a written complaint directed to the Board generally, or to any other Officer within it, will be regarded as valid.
The Board is not obliged to take any action in respect of a complaint about a breach of any of the IPPs if twelve months or more has elapsed since the complainant became aware of the alleged breach. Any complaint received within twelve months of the alleged breach will be acknowledged in writing by the Privacy Contact Officer within the time limits detailed in the IPA.
Upon receipt of the written complaint, the Privacy Contact Officer will promptly refer the written complaint to the Chair of the Board who will appoint an independent member of the Board to undertake an investigation of the complaint. Upon finalisation of the investigation, the appointed Board member will make a determination and the appointed Board member will then advise the complainant in writing of the decision within the time limits set out in the IPA.
Should the complainant be dissatisfied with the decision of the appointed Board member, the complainant may seek internal review of the decision. Internal review of the decision will be undertaken by the Chair or Deputy Chair of the Board.
If an application is made under the IPA or where a complainant receives a decision in respect of a complaint about a breach of the IPPs, the person may request internal review of the decision. A request for internal review must be in writing. It should be addressed to the Privacy Contact Officer but, again, where it is addressed to the Board generally or another Officer, it will be regarded as valid.
The Privacy Contact Officer (or other recipient) will acknowledge receipt of the internal review request as soon as practicable, and will immediately refer the internal review request to the Chair or Deputy Chair of the Board. The Chair or Deputy Chair will promptly commence an internal review of the decision under the IPA or a decision given to a complainant.
At the conclusion of the internal review process, the decision will be communicated in writing by the Chair or Deputy Chair of Board to the applicant or complainant.
If an application is made under the IPA or a complaint has been reviewed internally and the person is still dissatisfied with the decision, the person can refer their decision to the Information Privacy Commissioner under the terms of the IPA.
A request for external review must be in writing, state an address of the applicant/complainant to which notices may be forwarded, and give particulars of the decision, acts or practices to be reviewed.