Other issues in the complaint-handling process

Background

49.90 In addition to general issues about investigating and resolving complaints under the Privacy Act, stakeholders raised a number of concerns relating to specific provisions in the Act. These included those provisions dealing with representative complaints, preliminary inquiries and the conduct of investigations.

Representative complaints

49.91 The Privacy Act allows for the making of representative complaints, whereby one of a class of two or more individuals makes a complaint on behalf of all the individuals in the class.[125] A representative complaint can be lodged under s 36 if the class members have complaints against the same person; all the complaints are in respect of, or arise out of, the same or related circumstances; and all the complaints give rise to a substantial common issue of law or fact.[126]

49.92 The Commissioner has power to determine that a complaint should no longer be treated as a representative complaint, and may turn an individual complaint into a representative complaint.[127] The Commissioner also can replace the complainant with another class member and a class member can withdraw from a representative complaint at any time before the Commissioner begins to hold an inquiry into the complaint. Under ss 38(3) and 39 of the Privacy Act, representative complaints can be lodged without the consent of class members and a person who is a class member for a representative complaint is not entitled to lodge a complaint in respect of the same subject matter.[128]

Submissions and consultations

49.93 In DP 72, the ALRC identified a number of concerns raised by the OPC in relation to the procedures for making and pursuing representative complaints. One such concern was that an individual’s capacity to make an individual complaint could be removed without his or her knowledge or agreement, by virtue of the combination of ss 38(3) and 39 of the Privacy Act.[129]

49.94 To address this issue, the ALRC proposed that the Privacy Act should be amended to allow a class member of a representative complaint to withdraw from the complaint at any time if the class member has not consented to be a class member.[130]

49.95 The Australian Privacy Foundation submitted that, while there was no evidence of this problem occurring in practice, individuals should not be able to be named as parties to a complaint ‘against their will’.[131] This view was shared by a number of other stakeholders.[132]

ALRC’s view

49.96 The Privacy Act should be amended to allow a class member of a representative complaint to withdraw from the complaint at any time if the class member has not consented to be a class member. This would address the issue that an individual’s right to lodge a complaint can be removed by circumstances beyond his or her knowledge or control. The Human Rights and Equal Opportunity Commission Act contains a similar provision.[133]

49.97 In relation to the issue of standing, s 38A gives the Commissioner a broad discretion to determine that a complaint should not continue as a representative complaint when he or she is satisfied that it is in the interests of justice to do so. Reasons for making such a determination include that the complaint was not brought in good faith as a representative complaint, or where it is otherwise inappropriate that the complaints be pursued by means of a representative complaint.[134] These powers provide the OPC with adequate discretion to cease handling a complaint as a representative complaint where it was brought by a person with no standing.[135]

Recommendation 49–9 The Privacy Act should be amended to allow a class member to withdraw from a representative complaint at any time if the class member has not consented to be a class member.

Preliminary inquiries

49.98 Under s 42 of the Privacy Act, where a complaint is made to, or accepted by, the Commissioner, he or she has the power to make preliminary inquiries of the respondent. The power is limited by its purpose, which is to determine whether the Commissioner has power to investigate the matter complained about, or whether the Commissioner may exercise his or her discretion not to investigate the matter.

49.99 In DP 72, the ALRC proposed adoption of a suggestion of the OPC that the Commissioner should be given a specific power to contact third parties when undertaking preliminary inquiries into a complaint.[136] The OPC suggested this was particularly relevant when the complaint relates to a disputed credit default, in which case it is usually relevant to the assessment of the case for the OPC to seek a copy of the individual’s credit information file. The OPC submitted that, while it has the power to do anything ‘incidental or conducive to the performance of any of the Commissioner’s other functions’,[137] it would be appropriate to have a specific power to contact third parties in these circumstances.[138]

Submissions and consultations

49.100 Significant support was received for this proposal.[139] Some stakeholders commented that the Commissioner should have the appropriate authority to obtain all the relevant facts as early as possible in the complaint-handling process.[140]

49.101 Concern was expressed, however, by other stakeholders that the proposal could affect the confidentiality of the investigation. The Australian Direct Marketing Association stated that ‘the ability to disclose that an investigation is being undertaken to a third party may impugn the reputation and standing of the respondent’.[141]

49.102 The Law Society of New South Wales, while offering qualified support for the proposal, noted that inquiries of third parties must not jeopardise the complainant’s case and the complainant and the respondent should be informed of the names of the persons or entities the Commissioner intends to contact. The Law Society submitted that parties should be allowed to object to the Commissioner contacting third parties.[142] One stakeholder also was concerned that if the Commissioner was able to make inquiries of third parties, ‘the model for complaint determination will move from an adversarial to an inquisitorial model’.[143]

ALRC’s view

49.103 While other similar regulatory agencies, such as the Commonwealth Ombudsman, do not have the power to contact third parties during preliminary inquiries, they do have the same general powers as the Privacy Commissioner to undertake investigations and question third parties as required to perform their functions.

49.104 Section 42 of the Privacy Act should be amended to allow the Commissioner to contact third parties at the preliminary inquiry stage. While it is possible that a similar result could be achieved through the Commissioner’s ancillary function, it would be clearer and more transparent if the section itself provided specifically that the Commissioner has the ability to make inquiries of third parties. Any such inquiries should be made on a confidential basis. In the interests of fairness and transparency, the complainant should be informed of the Commissioner’s intention to make preliminary inquiries of a third party.

49.105 This amendment was sought from the OPC mostly to address issues in the context of credit reporting. While the ALRC acknowledges that the OPC could request the individual’s credit file directly from the individual, this recommendation also would help reduce delays in addressing complaints in the credit reporting context.

Recommendation 49–10 The Privacy Act should be amended to permit the Privacy Commissioner, in accepting a complaint or determining whether the Commissioner has the power to accept a complaint, to make preliminary inquiries of third parties as well as the respondent. The Privacy Commissioner should be required to inform the complainant that he or she intends to make inquiries of a third party.

Ceasing investigations if certain offences have been committed

49.106 If the Commissioner forms the opinion, in the course of an investigation, that a ‘credit reporting offence’ or ‘tax file number offence’ has been committed, he or she must inform the Commissioner of Police or the Commonwealth Director of Public Prosecutions (CDPP), and is to discontinue the investigation except to the extent that it concerns matters unconnected with the alleged offence. The Commissioner may continue with the investigation upon receiving a notice from the Commissioner of Police or the CDPP indicating that the matter will not, or will no longer be, the subject of proceedings for an offence.[144]

Submissions and consultations

49.107 In DP 72, the ALRC identified the concerns of the OPC about delays caused by the requirement to refer matters to the Australian Federal Police (AFP) for investigation. As the OPC’s investigation is suspended while the AFP decides whether to investigate, this can cause delay in resolving the complaint. The OPC suggested that a way to alleviate these problems would be for the ‘offence provisions to set a higher test than the test for an interference with privacy under the Privacy Act’, thereby giving the OPC a discretion not to refer a matter to the AFP where the conduct was not serious or caused no harm. While most offence provisions already set a higher test than for an interference with privacy (see, for example, s 18R), the exception is the tax file number offence under s 8WB of Taxation Administration Act 1953 (Cth).[145]

ALRC’s view

49.108 While noting the OPC’s concerns, the ALRC does not recommend that the Privacy Act be amended to set a higher test for referral of credit reporting or tax file number offences to the AFP. Although the operation of this provision can cause delays to the OPC’s investigation, the referral of offences to the AFP and the DPP is part of the broader prosecution policy of the Australian Government.[146] The ALRC also has recommended that the Privacy Act should be amended to remove the credit reporting offences and allow a civil penalty to be imposed.[147] This would limit the OPC’s concerns only to tax file number offences.

Conduct of investigations

49.109 The Privacy Act outlines how an investigation is to be conducted. As a general rule, an investigation is to be ‘conducted in private but otherwise in such manner as the Commissioner thinks fit’.[148] The Commissioner must inform parties when an investigation commences or ceases.[149] For the purposes of performing the Commissioner’s functions relating to a complaint (except a complaint under the NPPs or a code complaint accepted under s 40(1B)), the Commissioner can compel the complainant, respondent and any other relevant person to attend a conference.[150] The Commissioner also has the power, subject to certain limitations, to obtain information and documents from persons, and make inquiries of persons or examine witnesses on oath or affirmation.[151]

49.110 In addition to these requirements, the Privacy Act requires that complainants and respondents be given the opportunity to appear before the Commissioner in certain circumstances. In particular, the Commissioner must not make a finding under s 52 that is adverse to a complainant or respondent unless the Commissioner has afforded the complainant or respondent an opportunity to appear before the Commissioner and to make submissions orally, in writing, or both, in relation to the matter to which the investigation relates.[152] This requirement reflects the ‘hearing rule’ which, in the context of administrative decision making, is the common law rule that a statutory authority having power to affect the rights of a person is bound to afford the person a hearing before exercising the power.[153]

49.111 The rules of natural justice, including the hearing rule, can be modified or abrogated by statute.[154] For example, the Social Security (Administration) Act 1999 (Cth) provides that a party to a merits review of a decision before the Social Security Appeals Tribunal may make oral or written submissions, or both.[155] The Executive Director of the Social Security Appeals Tribunal may direct, however, that a hearing be conducted without oral submissions from the parties if: the Executive Director considers that the review hearing could be determined fairly on the basis of written submissions by the parties; and all the parties to the review consent to the hearing being conducted without oral submissions.[156]

49.112 The Administrative Appeals Tribunal Act 1975 (Cth) provides that a matter may be dealt with by considering documents or other material lodged with or provided to the AAT—without holding a hearing—if it appears to the AAT that the issues for determination on the review of a decision can ‘be adequately determined in the absence of parties; and the parties consent to the review being determined without a hearing’.[157]

49.113 In DP 72, the ALRC identified several issues raised by the OPC in relation to the Commissioner’s powers to conduct investigations. These included the OPC’s comments that the powers in ss 46 and 47 should be clarified to make it clear that they relate to a compulsory conciliation conference, and that the Commissioner should be empowered to compel parties to an NPP complaint—as well as other types of complaints—to attend a compulsory conference. The OPC also commented on the restrictions in s 69, in relation to personal information and documents that can be furnished or produced to the Commissioner during the investigation of a privacy complaint. Section 69 of the Act prevents people giving the Commissioner information generated for the purposes of taxation law or a law relating to the census or statistics, unless it relates to an individual who has made a complaint. Secondly, it sets out ‘very broad restrictions on the provision of information about an individual other than the complainant to the Commissioner’, requiring that such information can be provided only with the individual’s consent.

49.114 Finally, the OPC raised the issue of enabling the Commissioner to make a determination ‘on the papers’—without holding a hearing—in certain circumstances.[158]

Submissions and consultations

49.115 In DP 72, the ALRC made several proposals to address these concerns and increase the Commissioner’s investigatory powers. In particular, the ALRC proposed that:

  • s 46(1) of the Privacy Act should be amended to empower the Privacy Commissioner to compel parties to a complaint, and any other relevant person, to attend a compulsory conference;[159]

  • s 69(1) and (2) of the Privacy Act should be deleted, which would allow the Privacy Commissioner, in the context of an investigation of a privacy complaint, to collect personal information about an individual who is not the complainant;[160] and

  • the Privacy Act should be amended to provide that the Commissioner may direct that a hearing for a determination may be conducted without oral submissions from the parties, if the Commissioner considers that the matter could be determined fairly on the basis of written submissions by the parties and the complainant and respondent consent to the matter being determined without oral submissions.[161]

49.116 The proposal to extend the Commissioner’s power to compel a party to attend a compulsory conference to private sector complaints was supported in submissions by a number of stakeholders.[162]

49.117 The proposal to allow the Commissioner to collect personal information about an individual who is not the complainant also was generally supported.[163] Medicare Australia submitted that this would bring the Privacy Act in line with other legislation.[164] The Law Society of New South Wales noted, however, that privacy protection must be given to the third party in relation to that information.[165] Centrelink expressed concern that allowing the Commissioner to make direct approaches to other individuals who are not the complainant may have an impact on the investigation of complaints by the agency itself and duplicate resources.[166] The Australian Direct Marketing Association (ADMA) submitted that allowing the Commissioner to collect information about third parties may be open to abuse and impugn the reputation and standing of the respondent.[167]

49.118 The Law Society of New South Wales supported the proposal to allow the Commissioner to conduct a hearing for determination based on written submissions with the consent of the parties. It noted that this process could obviate the need for a formal hearing and assist in the early resolution of disputes.[168] The proposal also was supported by a number of privacy advocates and other stakeholders.[169]

49.119 The OPC agreed with the general premise of the proposal, but submitted that the Commissioner should have the power to direct that a hearing for a determination be conducted without oral submissions from the parties where he or she considers that the matter could be determined fairly on the basis of written submissions from the parties, even where the parties had not consented to this process. In the OPC’s view, this approach would give the Commissioner greater flexibility to conduct a hearing in a fair and efficient manner. The OPC argued that:

Were the Commissioner to consider that the matter could be determined fairly on the basis of written submissions for the parties, there would be no need to seek consent of the parties.[170]

ALRC’s view

49.120 In relation to compulsory conferences, the Explanatory Memorandum for the Privacy Bill made it clear that ss 46 and 47 were intended to empower the Commissioner to ‘direct persons to attend a compulsory conference in order to attempt a settlement of a complaint’.[171] The term ‘compulsory conference’ is used only in the section headings for ss 46 and 47. It is not necessary for the word ‘conciliation’ to be included in the section heading.[172] The OPC, however, could clarify the role of conferences in the conciliation process in the document setting out its complaint-handling policies and procedures.[173]

49.121 The power to compel parties to attend a compulsory conference should extend to where the complaint is a complaint about an organisation under the UPPs,[174] or a code complaint accepted under s 40(1B). Conciliation conferences are an important part of the conciliation process, and the Commissioner’s powers to resolve complaints should be consistent across all types of complaints. There appears to be no policy reason why the Commissioner should not have the same power to deal with private sector complaints as with complaints concerning agencies.

49.122 The restrictions in s 69(1)–(2) on the Commissioner’s ability to collect third party information in the process of investigating a complaint should be removed. These restrictions may fetter the ability of the Commissioner to resolve complaints efficiently and effectively, and are inconsistent with provisions applying to other regulators.[175] The ALRC also notes that the OPC is subject to secrecy provisions in s 96 of the Privacy Act, which make it an offence for the Commissioner or a member of his or her staff (present and past) to disclose, use or make a record of information acquired about a person in the performance of that role, other than to do something permitted or required by the Privacy Act.[176] These provisions provide protection for any information collected in an investigation.

49.123 In relation to the hearing requirements before a determination is made, the ALRC recommends that the Privacy Act should be amended to give the Commissioner flexibility to make determinations on the basis of written submissions in certain circumstances. The ALRC recognises that there may be situations where a determination could be made fairly and efficiently without parties appearing before the Commissioner to make oral submissions. The ALRC also recognises that Recommendation 49–5—that complainants and respondents be given the right, in certain circumstances, to require that a complaint be resolved by a determination—would, if implemented, give rise to a consequent right for the complainant or respondent to appear before the Commissioner before a determination is made. The combination of that recommendation and the current provision could increase the number of hearings held by the Commissioner, which may have significant resource implications for the OPC. There is merit, therefore, in giving the Commissioner greater flexibility to make determinations on the basis of written submissions.

49.124 There are several options to allow for determinations on the papers. The first is to remove the automatic right to appear before the Commissioner and instead give the Commissioner the discretion to provide a party with an opportunity to appear before him or her where the Commissioner considers that it would be fair in all the circumstances to make a determination based on written submissions. Under s 76 of the Administrative Decisions Tribunal Act 1997 (NSW), the Administrative Decisions Tribunal is given the power to determine proceedings without holding a hearing if the Tribunal believes the issues can be adequately determined in the absence of the parties.

49.125 The second option is to retain the current right to appear before the Commissioner to make oral or written submissions, but to provide explicitly that a hearing can be conducted on the basis of written submissions only where the parties agree. This is the approach taken in the Social Security (Administration) Act and was the ALRC’s preferred option in DP 72.

49.126 Since DP 72, the ALRC has formed the view that fairness to the parties is a more important concern than consent. Parties may consent to a hearing on the papers because they believe it will be easier or cheaper. This may not always produce a fair result however, particularly where a party has language, literacy or capacity issues that hinder his or her ability to present a case entirely in a written submission. It is appropriate for the Commissioner to determine when a matter could be determined fairly on the basis of written submissions by the parties. If one party did not consider that he or she could put his or her case adequately in a written submission, then the OPC should take this into account.

49.127 The ALRC therefore supports the view of the OPC that it should be granted the power to direct that a hearing may be conducted without oral submissions from the parties if the Privacy Commissioner is satisfied that the matter could be determined fairly on the basis of written submissions. The ALRC notes that determinations are reviewable by the AAT, so parties will have an avenue of appeal in the event that they dispute a decision of the Commissioner.

49.128 The document containing the OPC’s complaint-handling policies and procedures[177] should set out the factors the OPC will consider in deciding whether it is fair to determine the matter based on written submissions. These factors should include (but are not limited to): the relative ability of the parties to communicate effectively in writing; whether the parties have had access to legal advice; the complexity of the issues; the amount of information or evidence required from third parties; and whether it would be in the interests of fairness for the matter to be resolved without an oral hearing.

Recommendation 49–11 Section 46(1) of the Privacy Act should be amended to empower the Privacy Commissioner to compel parties to a complaint, and any other relevant person, to attend a compulsory conference.

Recommendation 49–12 The Privacy Act should be amended to allow the Privacy Commissioner, in the context of an investigation of a privacy complaint, to collect personal information about an individual who is not the complainant.

Recommendation 49–13 The Privacy Act should be amended to provide that the Privacy Commissioner may direct that a hearing for a determination may be conducted without oral submissions from the parties if the Privacy Commissioner is satisfied that the matter could be determined fairly on the basis of written submissions by the parties.

[125]Privacy Act 1988 (Cth) s 36(2).

[126] Ibid s 38(1).

[127] Ibid ss 38A, 38C.

[128] Ibid ss 38, 39.

[129] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[130] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 45–9.

[131] Australian Privacy Foundation, Submission PR 553, 2 January 2008.

[132] Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Australian Direct Marketing Association, Submission PR 543, 21 December 2007; GE Money Australia, Submission PR 537, 21 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Law Society of New South Wales, Submission PR 443, 10 December 2007.

[133]Human Rights and Equal Opportunity Act 1986 (Cth) s 46PC.

[134]Privacy Act 1988 (Cth) s 38A(2)(c), (d).

[135] See also Australian Law Reform Commission, Beyond the Door-Keeper: Standing to Sue for Public Remedies, ALRC 78 (1996).

[136] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 45–10.

[137]Privacy Act 1988 (Cth) s 27(1)(s).

[138] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[139] Australian Privacy Foundation, Submission PR 553, 2 January 2008; GE Money Australia, Submission PR 537, 21 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; P Youngman, Submission PR 394, 7 December 2007.

[140] Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Medicare Australia, Submission PR 534, 21 December 2007.

[141] Australian Direct Marketing Association, Submission PR 543, 21 December 2007. PIAC also noted that third parties should be made aware of the importance of confidentiality in the investigation and conciliation process: Public Interest Advocacy Centre, Submission PR 548, 26 December 2007.

[142] Law Society of New South Wales, Submission PR 443, 10 December 2007.

[143] Confidential, Submission PR 536, 21 December 2007.

[144]Privacy Act 1988 (Cth) s 49. An example of the operation of this provision is provided in F and G v Taxation Accountant [2006] PrivCmrA 6.

[145] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[146] In particular, see Commonwealth Director of Public Prosecutions, Prosecution Policy of the Commonwealth (1992). The AFP also prioritises matters for investigations pursuant to its Australian Federal Police, Case Categorisation and Prioritisation Model (2006). Section 8WB of the Taxation Administration Act is currently under review by the Australian Government Treasury as part of the inquiry into secrecy and disclosure provisions in Australian taxation law: see Australian Government—The Treasury, Review of Taxation Secrecy and Disclosure Provisions: Discussion Paper (2006).

[147] Rec 59­–9. See also Rec 50–2.

[148]Privacy Act 1988 (Cth) s 43(2).

[149] Ibid ss 43(1), 48.

[150] Ibids 46(1). It is an offence to fail to attend such a conference as required by the Commissioner: Privacy Act 1988 (Cth)s 46(2).

[151]Privacy Act 1988 (Cth)ss 44–46. It is an offence not to comply with the Commissioner’s directions: Privacy Act 1988 (Cth) ss 46(2), 65–66.

[152]Privacy Act 1988 (Cth) s 43(4)–(5).

[153] See R Creyke and J McMillan, Control of Government Action: Text, Cases & Commentary (2005); Twist v Council of the Municipality of Randwick (1976) 136 CLR 106, 110.

[154]Kioa v Minister for Immigration and Ethnic Affairs (1985) 159 CLR 550.

[155]Social Security (Administration) Act 1999 (Cth) s 161.

[156] Ibid s 162.

[157]Administrative Appeals Tribunal Act 1975 (Cth) s 34J. Note that s 76 of the Administrative Decisions Tribunal Act 1997 (NSW) gives the Administrative Decisions Tribunal power to determine proceedings without holding a hearing if the Tribunal believes the issues can be adequately determined in the absence of the parties.

[158] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[159] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 45–11.

[160] Ibid, Proposal 45–12.

[161] Ibid, Proposal 45–13.

[162] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; GE Money Australia, Submission PR 537, 21 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.

[163] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; GE Money Australia, Submission PR 537, 21 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.

[164] Medicare Australia, Submission PR 534, 21 December 2007.

[165] Law Society of New South Wales, Submission PR 443, 10 December 2007.

[166] Australian Government Centrelink, Submission PR 555, 21 December 2007.

[167] Australian Direct Marketing Association, Submission PR 543, 21 December 2007.

[168] Law Society of New South Wales, Submission PR 443, 10 December 2007.

[169] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007. The proposal also was supported by the Australian Direct Marketing Association, Submission PR 543, 21 December 2007 and Veda Advantage, Submission PR 498, 20 December 2007.

[170] Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.

[171] Explanatory Memorandum, Privacy Bill 1988 (Cth). This interpretation of compulsory conferences also is consistent with Human Rights and Equal Opportunity Act 1986 (Cth) ss 46PJ(1), 46PF(1).

[172] Under the Acts Interpretation Act 1901 (Cth) s 13(3), a section heading is not considered to be part of the Act, meaning that the heading cannot be used in interpreting the meaning of a section.

[173] Rec 49–8.

[174] If Rec 18–2 is adopted, there will be a single set of privacy principles—the model UPPs.

[175] For example, there is no equivalent provision in the Human Rights and Equal Opportunity Act 1986 (Cth) or other state or territory privacy legislation.

[176]Privacy Act 1988 (Cth) s 96(1), (3). The offence is punishable by a penalty of $5,000 or imprisonment for one year, or both. Note that the OPC released its privacy policy (which sets out its personal information handling practices) in August 2006: Office of the Privacy Commissioner, Privacy Policy (2006).

[177] Rec 49–8.