45.33 As noted above, since the commencement of the Privacy Act, the responsibilities of the OPC have widened significantly, with more functions and powers being vested in the Commissioner. These changes have not always been accompanied by a commensurate increase in resources.

45.34 A key theme in this Inquiry has been a lack of confidence among stakeholders in OPC as both the industry regulator and the complaint-handling body for privacy complaints (including credit reporting). For example, stakeholders expressed the view that the OPC has taken too long to resolve complaints and dismissed complaints too readily.[24] One stakeholder argued:

With limited resources, there is always a tension between undertaking individual complaints handling and working to address broader, systemic issues. Neither function, however, should be ignored.[25]

45.35 Many of these problems can be attributed to the increase in the OPC’s functions with the addition of the responsibilities for the private sector in 2001 without a corresponding increase in budget. In 2006, the OPC’s budget was enhanced, which has allowed it to devote resources to clearing the backlog of complaints and shift its focus towards other areas of responsibility.

45.36 The recommendations contained in this part of the Report, and the ALRC’s other recommendations for greater clarity, guidance and new responsibilities under the Privacy Act[26] will have significant resource implications for the OPC. It is critical that the OPC remain adequately resourced so that it is able to implement recommended initiatives and retain the trust of the entities subject to the Privacy Act and the community at large. Without adequate resourcing, the beneficial outcomes that will flow from the implementation of the ALRC’s recommendations will not be realised.

[24] See Ch 49.

[25] Galexia Pty Ltd, Submission PR 465, 13 December 2007.

[26] See, eg, Recs 6–2, 10–3, 16–2, 19–1, 21–2, 23–3, 40–2, 56–7, 60–3, 67–2, 74–7.