Investigation and resolution of privacy complaints

45.17 Concern has been expressed by stakeholders about the current complaint-handling process in the Privacy Act. In Chapter 49, the ALRC makes recommendations to reform the existing provisions to streamline, and increase the effectiveness of, complaint handling under the Act.

Addressing systemic issues

45.18 Stakeholders in this Inquiry and previous inquiries conducted on aspects of the Privacy Act, have consistently expressed concern about the ability of the OPC to address systemic issues in privacy compliance. By systemic issues, the ALRC is referring to ‘issues that are about an organisation’s or industry’s practice rather than about an isolated incident’.[14]

45.19 To facilitate a shift in focus to systemic issues, the ALRC has made a number of recommendations that would permit the OPC to devolve some of the responsibility for handling privacy complaints under the Act. Some privacy complaints, particularly in the credit reporting area, could be handled by external dispute resolution schemes. The ALRC recommends that the Privacy Commissioner be given a specific decline and referral power for these purposes.[15]

45.20 The ALRC also recommends that the Privacy Commissioner’s power to remedy systemic issues be enhanced by empowering the Commissioner to prescribe, in a determination, the steps an agency or organisation must take to comply with the Privacy Act.[16]

Framework for conciliation and determination

45.21 The second central issue examined in Chapter 49 is the manner in which complaints are resolved under the Privacy Act. The ALRC recommends that the Act be amended to include a new framework to deal with conciliation and determination. This framework would, among other things, give complainants and respondents the right, in certain circumstances, to require the Commissioner to resolve a complaint by determination.[17]

Accountability and transparency

45.22 Chapter 49 also considers issues of accountability and transparency in handling privacy complaints. The ALRC recommends that the Privacy Act be amended to provide merits review of all determinations made by the Privacy Commissioner and that the OPC publish a document setting out its complaint-handling policies and procedures.[18]

[14] Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 130 fn 102.

[15] Rec 49–2.

[16] Rec 49–6.

[17] Rec 49–5.

[18] Rec 49–7, 49–8.