Resolution of privacy complaints

Model under the Privacy Act

49.39 The Privacy Act provides two formal ways of resolving a complaint following an investigation. First, the Commissioner can endeavour, by conciliation, to effect a settlement between the complainant and respondent.^[46] Secondly, the Commissioner can make a determination either dismissing the complaint or finding the complaint substantiated.^[47]

Conciliation

49.40 The Commissioner is given the general direction in complaints against both agencies and organisations, to attempt, by conciliation, to effect a settlement of the matters that gave rise to the investigation. The Commissioner is required to conciliate a complaint only where he or she considers it appropriate to do so.^[48] In contrast to other privacy legislation, the Privacy Act does not set out detailed provisions on how to conduct the conciliation process.^[49]

49.41 In practice, the OPC will conciliate complaints where it thinks there is enough evidence to support the complaint. The OPC conciliates by writing or telephoning the respondent to see if it agrees to the complainant’s solution, or bringing the parties together in a conciliation conference.^[50] If the parties reach an agreement during conciliation, the OPC closes the file on the basis that the respondent has dealt adequately with the matter. The OPC received a total of 1,094 complaints in 2006–07,^[51] and closed 1,210 complaints, representing a 7% increase on the number closed in 2005–06.^[52] Of the complaints closed following an investigation, the typical outcomes involved apologies to complainants, changes to database systems, correction of records, provision of access to records and compensation.^[53]

49.42 If the parties cannot reach agreement during conciliation, the Commissioner will make a decision about how the complaint should be resolved. That decision may be that the respondent has made the complainant a reasonable offer which has not been accepted, in which case the Commissioner may close the file on the grounds that the respondent has dealt with the matter adequately, even if the complainant does not agree. Alternatively, the Commissioner may decide that the respondent has not made a reasonable offer, in which case the Commissioner can make a determination instructing the respondent on how to resolve the complaint, including ordering the respondent to apologise, pay compensation or change its practices.^[54]

Determinations

49.43 As noted above, the Commissioner can make a determination dismissing the complaint, or can find a complaint substantiated and make a determination that includes one or more of the following declarations that:

• the respondent has engaged in conduct constituting an interference with the privacy of an individual and should not repeat or continue such conduct;^[55]
• the respondent should perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant;^[56]
• the complainant is entitled to a specified amount by way of compensation for any loss or damage;^[57] or
• it would be inappropriate for any further action to be taken in the matter.^[58]

49.44 A determination of the Commissioner under s 52(1) is not binding or conclusive between any of the parties to the determination.^[59] This reflects the fact that Commonwealth judicial power only can be exercised by a court in accordance with Chapter III of the Australian Constitution.^[60] Enforcement of determinations is discussed in Chapter 50.

49.45 There have been eight complaint determinations made since the Privacy Act commenced in 1989, with the most recent being in 2004.^[61] Following a number of submissions from stakeholders commenting on the limited exercise of the determination power and suggesting that complainants should be able to compel the Commissioner to make a determination, the OPC Review recommended that it would consider circumstances in which it might be appropriate to make greater use of the Commissioner’s power to make determinations under s 52.^[62] Since then, the OPC has reviewed the use of the s 52 determination powers and identified situations where it may proceed more quickly to a determination, including where the:

• interests of the parties will be better served by the opportunity to make formal submissions to the Commissioner;
• issues in the complaint are not clear and the Commissioner will need to make findings; or
• complaint is not amenable to conciliation, or conciliation has failed.^[63]

49.46 The OPC also clarified that determinations would ‘not necessarily be limited to the most serious cases, nor will determinations issued by the Commissioner necessarily be punitive’.^[64]

49.47 The other issue with determinations identified by stakeholders in the OPC Review was the inability of the Commissioner to prescribe remedies to prevent future harm. The issue was said to be illustrated in determinations made against a residential tenancy database operator in 2004. In those determinations, the Commissioner found that, while he could declare that the respondent should not repeat or continue conduct that constitutes an interference with the privacy of an individual, he did not have the power to prescribe how the respondent should act in the future.^[65] Following concerns from stakeholders that this restriction limited the Commissioner’s ability to address systemic issues, the OPC recommended that the Government consider amending the Privacy Act to expand the remedies available under a determination to include giving the Commissioner power to require a respondent to take steps to prevent future harm arising from systemic issues.^[66] In its response to the OPC Review, the Australian Government agreed with this recommendation.^[67]

Submissions and consultations

49.48 In DP 72, the ALRC identified a number of concerns raised by stakeholders about the complaint-resolution process under Privacy Act and the OPC’s procedures. These concerns were grouped into: issues with the framework for conciliation in the Act; the difficulty in distinguishing between the stages of investigation, conciliation and determination under the Act; and the timing of these stages. Concerns also were expressed about the limited use of the determinations power by the Commissioner, with suggestions made that complainants should have the right to compel a determination where conciliation fails. The third area of concern was the limited ability for a determination to effect systemic change, as it cannot prescribe positive steps for a respondent to take to achieve compliance with the Act.^[68]

49.49 Having regard to these issues, the ALRC made several proposals to clarify the complaint-handling process under the Privacy Act.

Clarifying the Commissioner’s functions

49.50 First, the ALRC proposed that s 27(1)(a) and (ab) should be amended to clarify that the Commissioner’s functions in relation to complaint handling include:

• receiving complaints about an act or practice that may be an interference with the privacy of an individual;
• investigating the act or practice about which a complaint has been made; and
• where the Commissioner considers it appropriate to do so, and at any stage after acceptance of the complaint, to endeavour, by conciliation, to effect a settlement of the matters that gave rise to the complaint or to make a determination in respect of the complaint under s 52.^[69]

49.51 Stakeholders who commented on this proposal supported it unanimously.^[70]

New conciliation provisions

49.52 Secondly, the ALRC proposed that Privacy Act should be amended to include new provisions dealing expressly with conciliation, and that the provisions should give effect to the following:

(a) If, at any stage after receiving the complaint, the Commissioner considers it reasonably possible that the complaint may be conciliated successfully, he or she must make all reasonable attempts to conciliate the complaint.

(b) Where, in the opinion of the Commissioner, all reasonable attempts to settle the complaint by conciliation have been made and the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation, the Commissioner must notify the complainant and respondent that conciliation has failed and the complainant or respondent may require that the complaint be resolved by determination.

(c) Evidence of anything said or done in the course of a conciliation is not admissible in a determination hearing or any enforcement proceedings relating to the complaint, unless all parties to the conciliation otherwise agree.^[71]

49.53 The OPC agreed with aspects of this proposal, but suggested the following changes:

• to be consistent with other proposals, the reference in (a) to ‘receiving’ a complaint should be changed to ‘accepting’;
• the requirement that the Commissioner make ‘all reasonable attempts’ to conciliate is too uncertain and should be changed to ‘reasonable attempts’; and
• a complainant or respondent should not be able to require that the complaint be resolved by determination. In the OPC’s view, where the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation, the Commissioner should be required to notify the complainant and respondent that conciliation has failed. The Commissioner must then decide whether to decline the complaint, investigate or investigate further, or resolve the complaint by determination.^[72]

49.54 A majority of stakeholders, however, were supportive of the proposal, and in particular, allowing that a determination be requested where conciliation had failed.^[73] PIAC argued that:

A major problem with the current regulatory system has been the failure of successive Privacy Commissioners to make determinations under section 52 and the inability of plaintiffs or defendants to compel them to do so. If the plaintiff or respondent can require that a matter be resolved by determination, the number of determinations made by the Privacy Commissioner should increase and there is at last potential for a solid body of jurisprudence to develop about the interpretation of the provisions of the Act.^[74]

49.55 The Australian Policy Foundation and the Cyberspace Law and Policy Centre both submitted that an applicant also should have the right to require a determination whenever the Commissioner proposes to refuse to investigate (or investigate further) a complaint.^[75]

49.56 One stakeholder took the view that giving complainants the power to ask for a determination would give them significant leverage to force respondents to agree to compensation to avoid the ‘time-consuming’ formal determination process.^[76]

Declarations for action

49.57 Thirdly, the ALRC proposed that s 52 of the Privacy Act should be amended to empower the Commissioner to make a declaration in a determination that an agency or respondent must take specified action within a specified period for the purpose of ensuring compliance with the Act.^[77]

49.58 A number of stakeholders commented on this proposal, with most expressing support.^[78] Telstra Corporation Limited did not support the proposal, however, on the basis that ‘it is inappropriate to empower the Privacy Commissioner to determine specific compliance measures for organisations’. In Telstra’s view, under an outcome-based regulatory regime, organisations are the correct bodies to determine what measures should be adopted within their own businesses to achieve compliance.^[79]

ALRC’s view

Framework for conciliation and determinations

49.59 The current relationship in the Privacy Act between conciliation and determination is not clear. An explanation of the intended relationship was provided in the Second Reading Speech for the Privacy Bill 1988 (Cth), where the then Attorney-General stated:

Under the Bill an individual will be able to complain to the Privacy Commissioner about alleged interferences with privacy, who will attempt to resolve the allegations by conciliation and, failing that, making binding determinations against agencies, including determinations for compensation and costs.^[80]

49.60 The relationship between conciliation and determination, and the Commissioner’s functions in relation to each, should be clarified in the Privacy Act. The ALRC recommends that the Privacy Act be amended to clarify the Commissioner’s functions in relation to complaint handling and the process to be followed when a complaint is received. This could be achieved by amending s 27(1)(a) and (ab) to clarify the Commissioner’s functions relating to privacy complaints, including the functions of receiving and investigating complaints, conciliating where appropriate or making a determination. Consistent with the recommendation that the Privacy Act be amended to achieve greater logical consistency, simplicity and clarity,^[81] this amendment would, if implemented, provide a succinct summary of the Commissioner’s functions in relation to the investigation and resolution of privacy complaints. It also would clarify the Commissioner’s ability to conciliate a complaint at any stage after receiving it.^[82]

49.61 The ALRC also recommends that the Privacy Act should be amended to include new provisions dealing expressly with conciliation. These provisions should clarify that the Commissioner must use reasonable attempts to conciliate a complaint where the Commissioner thinks it reasonably possible that the complaint may be conciliated successfully. This expands on the existing obligation of the Commissioner in s 27 to conciliate complaints where appropriate, and is similar to obligations of privacy commissioners under other privacy legislation.^[83] The ALRC notes the concerns of the OPC in relation to the words ‘all reasonable attempts’, and agrees that the term ‘reasonable attempts’ is appropriate in this context.

49.62 In addition, the provisions should set out clearly what happens when conciliation fails. The ALRC recommends that conciliation will be taken to have failed where, in the opinion of the Commissioner, reasonable attempts to settle the complaint by conciliation have been made and the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation. This framework adopts language from industrial relations legislation, where conciliation and arbitration are well-established practices in resolving disputes.^[84] State and territory privacy legislation also provides expressly for conciliation failing or being unsuccessful.^[85] This amendment would, if implemented, provide clearer parameters in which to conduct conciliation.

49.63 Finally, the ALRC recommends that the Act should be amended to provide that, where the Commissioner is of the opinion that conciliation has failed, the Commissioner must notify the complainant and respondent of this conclusion and the complainant or respondent may require that the complaint be resolved by determination.

49.64 This recommendation is analogous to the provisions in the Information Privacy Act 2000 (Vic), where, if the Commissioner has attempted unsuccessfully to conciliate a complaint, he or she must notify the complainant and the respondent in writing, and the complainant may require the Commissioner to refer the complaint to the Victorian Civil and Administrative Tribunal for hearing.^[86] It is also comparable to the approach in the Human Rights and Equal Opportunity Commission Act 1986 (Cth) where, if the President terminates a complaint on the basis that he or she is satisfied that there is no reasonable prospect of the matter being settled by conciliation, any person affected in relation to the complaint may make an application to the Federal Court or the Federal Magistrates Court alleging unlawful discrimination by the respondent.^[87] The ALRC’s recommended model also is similar to the relationship between conciliation and arbitration in state industrial relations legislation.^[88]

49.65 This recommendation, if implemented, should lead to an increase in the number of determinations issued by the OPC, which would help address concerns from stakeholders about the lack of jurisprudence on the Privacy Act.^[89] The recommendation should increase public enforcement and awareness of the Act, which is consistent with Parliament’s expectation that the Commissioner ‘be the means by which there will be accountability to the public on the use by government of their personal information’.^[90] It also is consistent with the legislative intention that determinations be issued where conciliation has failed. The presence of the power to request a determination should provide a real incentive for agencies and organisations to engage in the conciliation process, which some stakeholders suggest has been lost due to the very limited number of determinations issued. In addition, the ALRC is concerned that the conciliation process cannot properly occur under the Act where it is open to the Commissioner to close the complaint when it decides that the respondent has made an offer that adequately deals with the complaint.

49.66 Recommendation 45–13, below, will allow the Commissioner to make a determination without oral hearing where he or she believes the matter could be determined fairly on the basis of written submissions. This will mean that the determination process may be quicker and not as costly to parties and the OPC as it is under the current arrangements. It will not be as great a burden on the OPC, therefore, for a party to compel a determination where conciliation has failed.

49.67 There is some risk that providing a right to compel a determination may encourage vexatious litigants and add to the unreasonable expectations sometimes held by complainants about how a complaint will be resolved. The model recommended by the ALRC, however, incorporates adequate safeguards against vexatious and trivial conduct, as it operates only in relation to complaints that the Commissioner has not dismissed under s 41. That is, the complaint must have passed the threshold requirements of being in time; involving a possible breach; and not being frivolous, vexatious, misconceived or lacking in substance. The complaint, therefore, must have a degree of merit. The recommendation also requires the complainant and respondent to have made a genuine and concerted effort to conciliate the complaint.

49.68 Finally, the ALRC recommends that the Act should be amended to protect evidence produced in the conciliation process from being used in a determination hearing or later enforcement proceedings. This recommendation is based on a provision in the Victorian Information Privacy Act,^[91] and is intended to encourage parties to engage in full and frank negotiations as part of conciliation. Where, however, the communication or evidence in issue was made in furtherance of the commission of a fraud or an offence, or in the commission of an act that would render a person liable to a civil penalty, the evidence should not be protected.^[92]

49.69 Complainants should not have a right to request a determination if their complaint is dismissed. Given that many complaints are dismissed on the basis that they are trivial, frivolous, vexatious, lacking in substance or the Commissioner lacks jurisdiction, it would not be a feasible or a productive use of the OPC’s resources to require a determination (potentially) in each case.

Addressing systemic issues

49.70 The ALRC recognises the need for the Commissioner to be able to prescribe remedies that address systemic issues and effect systemic changes in agencies, organisations and industries. The ALRC recommends that the Commissioner’s determination powers under s 52 should be amended to empower the Commissioner to make a declaration in a determination that a respondent must take specified action within a specified period for the purpose of ensuring compliance with the Privacy Act.^[93] The ability to prescribe how the respondent should act to comply with, for example, the model Uniform Privacy Principles (UPPs) should end the difficulty described by stakeholders of not knowing how to prevent future harm. It also should provide greater certainty to agencies, organisations and the public on what behaviour is consistent with the principles or regulations.^[94]

49.71 While a determination may relate to an individual complaint, that individual complaint may itself be about a systemic issue. Empowering the Commissioner to prescribe remedies that are able to address systemic issues in the complaint-handling process allows the Commissioner to achieve maximum change from each determination.

49.72 It also should be noted that a declaration to take specified action to comply with the Privacy Act would be one of several declarations that the Commissioner can make as part of a determination under s 52.^[95] As is the case with other determinations, it would not be binding or conclusive between parties.^[96] A determination would be subject to merits review by the Administrative Appeals Tribunal (AAT).^[97]

49.73 The ALRC does not agree that this recommendation is incompatible with outcomes-based or principles-based regulation. As noted in Chapter 4, a principles-based regime does not mean that agencies and organisations always will be left to find their own way of achieving compliance after an instance of non-compliance. In some instances, the particulars of the breach may demonstrate that the respondent is having trouble, either deliberately or in good faith, with finding its own way to achieving the desired outcome. In such circumstances, the appropriate enforcement response may be to prescribe the steps the respondent should take to achieve compliance with the principle. For example, the OPC would not tell a business what price it should set for access to information. It may, however, through its determination, direct an organisation to develop a price for access to information that is reasonable, having regard to whatever factors may be relevant in the circumstances.