16.08.2010
Model under the Privacy Act
49.39 The Privacy Act provides two formal ways of resolving a complaint following an investigation. First, the Commissioner can endeavour, by conciliation, to effect a settlement between the complainant and respondent.[46] Secondly, the Commissioner can make a determination either dismissing the complaint or finding the complaint substantiated.[47]
Conciliation
49.40 The Commissioner is given the general direction in complaints against both agencies and organisations, to attempt, by conciliation, to effect a settlement of the matters that gave rise to the investigation. The Commissioner is required to conciliate a complaint only where he or she considers it appropriate to do so.[48] In contrast to other privacy legislation, the Privacy Act does not set out detailed provisions on how to conduct the conciliation process.[49]
49.41 In practice, the OPC will conciliate complaints where it thinks there is enough evidence to support the complaint. The OPC conciliates by writing or telephoning the respondent to see if it agrees to the complainant’s solution, or bringing the parties together in a conciliation conference.[50] If the parties reach an agreement during conciliation, the OPC closes the file on the basis that the respondent has dealt adequately with the matter. The OPC received a total of 1,094 complaints in 2006–07,[51] and closed 1,210 complaints, representing a 7% increase on the number closed in 2005–06.[52] Of the complaints closed following an investigation, the typical outcomes involved apologies to complainants, changes to database systems, correction of records, provision of access to records and compensation.[53]
49.42 If the parties cannot reach agreement during conciliation, the Commissioner will make a decision about how the complaint should be resolved. That decision may be that the respondent has made the complainant a reasonable offer which has not been accepted, in which case the Commissioner may close the file on the grounds that the respondent has dealt with the matter adequately, even if the complainant does not agree. Alternatively, the Commissioner may decide that the respondent has not made a reasonable offer, in which case the Commissioner can make a determination instructing the respondent on how to resolve the complaint, including ordering the respondent to apologise, pay compensation or change its practices.[54]
Determinations
49.43 As noted above, the Commissioner can make a determination dismissing the complaint, or can find a complaint substantiated and make a determination that includes one or more of the following declarations that:
- the respondent has engaged in conduct constituting an interference with the privacy of an individual and should not repeat or continue such conduct;[55]
- the respondent should perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant;[56]
- the complainant is entitled to a specified amount by way of compensation for any loss or damage;[57] or
- it would be inappropriate for any further action to be taken in the matter.[58]
49.44 A determination of the Commissioner under s 52(1) is not binding or conclusive between any of the parties to the determination.[59] This reflects the fact that Commonwealth judicial power only can be exercised by a court in accordance with Chapter III of the Australian Constitution.[60] Enforcement of determinations is discussed in Chapter 50.
49.45 There have been eight complaint determinations made since the Privacy Act commenced in 1989, with the most recent being in 2004.[61] Following a number of submissions from stakeholders commenting on the limited exercise of the determination power and suggesting that complainants should be able to compel the Commissioner to make a determination, the OPC Review recommended that it would consider circumstances in which it might be appropriate to make greater use of the Commissioner’s power to make determinations under s 52.[62] Since then, the OPC has reviewed the use of the s 52 determination powers and identified situations where it may proceed more quickly to a determination, including where the:
- interests of the parties will be better served by the opportunity to make formal submissions to the Commissioner;
- issues in the complaint are not clear and the Commissioner will need to make findings; or
- complaint is not amenable to conciliation, or conciliation has failed.[63]
49.46 The OPC also clarified that determinations would ‘not necessarily be limited to the most serious cases, nor will determinations issued by the Commissioner necessarily be punitive’.[64]
49.47 The other issue with determinations identified by stakeholders in the OPC Review was the inability of the Commissioner to prescribe remedies to prevent future harm. The issue was said to be illustrated in determinations made against a residential tenancy database operator in 2004. In those determinations, the Commissioner found that, while he could declare that the respondent should not repeat or continue conduct that constitutes an interference with the privacy of an individual, he did not have the power to prescribe how the respondent should act in the future.[65] Following concerns from stakeholders that this restriction limited the Commissioner’s ability to address systemic issues, the OPC recommended that the Government consider amending the Privacy Act to expand the remedies available under a determination to include giving the Commissioner power to require a respondent to take steps to prevent future harm arising from systemic issues.[66] In its response to the OPC Review, the Australian Government agreed with this recommendation.[67]
Submissions and consultations
49.48 In DP 72, the ALRC identified a number of concerns raised by stakeholders about the complaint-resolution process under Privacy Act and the OPC’s procedures. These concerns were grouped into: issues with the framework for conciliation in the Act; the difficulty in distinguishing between the stages of investigation, conciliation and determination under the Act; and the timing of these stages. Concerns also were expressed about the limited use of the determinations power by the Commissioner, with suggestions made that complainants should have the right to compel a determination where conciliation fails. The third area of concern was the limited ability for a determination to effect systemic change, as it cannot prescribe positive steps for a respondent to take to achieve compliance with the Act.[68]
49.49 Having regard to these issues, the ALRC made several proposals to clarify the complaint-handling process under the Privacy Act.
Clarifying the Commissioner’s functions
49.50 First, the ALRC proposed that s 27(1)(a) and (ab) should be amended to clarify that the Commissioner’s functions in relation to complaint handling include:
- receiving complaints about an act or practice that may be an interference with the privacy of an individual;
- investigating the act or practice about which a complaint has been made; and
- where the Commissioner considers it appropriate to do so, and at any stage after acceptance of the complaint, to endeavour, by conciliation, to effect a settlement of the matters that gave rise to the complaint or to make a determination in respect of the complaint under s 52.[69]
49.51 Stakeholders who commented on this proposal supported it unanimously.[70]
New conciliation provisions
49.52 Secondly, the ALRC proposed that Privacy Act should be amended to include new provisions dealing expressly with conciliation, and that the provisions should give effect to the following:
(a) If, at any stage after receiving the complaint, the Commissioner considers it reasonably possible that the complaint may be conciliated successfully, he or she must make all reasonable attempts to conciliate the complaint.
(b) Where, in the opinion of the Commissioner, all reasonable attempts to settle the complaint by conciliation have been made and the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation, the Commissioner must notify the complainant and respondent that conciliation has failed and the complainant or respondent may require that the complaint be resolved by determination.
(c) Evidence of anything said or done in the course of a conciliation is not admissible in a determination hearing or any enforcement proceedings relating to the complaint, unless all parties to the conciliation otherwise agree.[71]
49.53 The OPC agreed with aspects of this proposal, but suggested the following changes:
- to be consistent with other proposals, the reference in (a) to ‘receiving’ a complaint should be changed to ‘accepting’;
- the requirement that the Commissioner make ‘all reasonable attempts’ to conciliate is too uncertain and should be changed to ‘reasonable attempts’; and
- a complainant or respondent should not be able to require that the complaint be resolved by determination. In the OPC’s view, where the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation, the Commissioner should be required to notify the complainant and respondent that conciliation has failed. The Commissioner must then decide whether to decline the complaint, investigate or investigate further, or resolve the complaint by determination.[72]
49.54 A majority of stakeholders, however, were supportive of the proposal, and in particular, allowing that a determination be requested where conciliation had failed.[73] PIAC argued that:
A major problem with the current regulatory system has been the failure of successive Privacy Commissioners to make determinations under section 52 and the inability of plaintiffs or defendants to compel them to do so. If the plaintiff or respondent can require that a matter be resolved by determination, the number of determinations made by the Privacy Commissioner should increase and there is at last potential for a solid body of jurisprudence to develop about the interpretation of the provisions of the Act.[74]
49.55 The Australian Policy Foundation and the Cyberspace Law and Policy Centre both submitted that an applicant also should have the right to require a determination whenever the Commissioner proposes to refuse to investigate (or investigate further) a complaint.[75]
49.56 One stakeholder took the view that giving complainants the power to ask for a determination would give them significant leverage to force respondents to agree to compensation to avoid the ‘time-consuming’ formal determination process.[76]
Declarations for action
49.57 Thirdly, the ALRC proposed that s 52 of the Privacy Act should be amended to empower the Commissioner to make a declaration in a determination that an agency or respondent must take specified action within a specified period for the purpose of ensuring compliance with the Act.[77]
49.58 A number of stakeholders commented on this proposal, with most expressing support.[78] Telstra Corporation Limited did not support the proposal, however, on the basis that ‘it is inappropriate to empower the Privacy Commissioner to determine specific compliance measures for organisations’. In Telstra’s view, under an outcome-based regulatory regime, organisations are the correct bodies to determine what measures should be adopted within their own businesses to achieve compliance.[79]
ALRC’s view
Framework for conciliation and determinations
49.59 The current relationship in the Privacy Act between conciliation and determination is not clear. An explanation of the intended relationship was provided in the Second Reading Speech for the Privacy Bill 1988 (Cth), where the then Attorney-General stated:
Under the Bill an individual will be able to complain to the Privacy Commissioner about alleged interferences with privacy, who will attempt to resolve the allegations by conciliation and, failing that, making binding determinations against agencies, including determinations for compensation and costs.[80]
49.60 The relationship between conciliation and determination, and the Commissioner’s functions in relation to each, should be clarified in the Privacy Act. The ALRC recommends that the Privacy Act be amended to clarify the Commissioner’s functions in relation to complaint handling and the process to be followed when a complaint is received. This could be achieved by amending s 27(1)(a) and (ab) to clarify the Commissioner’s functions relating to privacy complaints, including the functions of receiving and investigating complaints, conciliating where appropriate or making a determination. Consistent with the recommendation that the Privacy Act be amended to achieve greater logical consistency, simplicity and clarity,[81] this amendment would, if implemented, provide a succinct summary of the Commissioner’s functions in relation to the investigation and resolution of privacy complaints. It also would clarify the Commissioner’s ability to conciliate a complaint at any stage after receiving it.[82]
49.61 The ALRC also recommends that the Privacy Act should be amended to include new provisions dealing expressly with conciliation. These provisions should clarify that the Commissioner must use reasonable attempts to conciliate a complaint where the Commissioner thinks it reasonably possible that the complaint may be conciliated successfully. This expands on the existing obligation of the Commissioner in s 27 to conciliate complaints where appropriate, and is similar to obligations of privacy commissioners under other privacy legislation.[83] The ALRC notes the concerns of the OPC in relation to the words ‘all reasonable attempts’, and agrees that the term ‘reasonable attempts’ is appropriate in this context.
49.62 In addition, the provisions should set out clearly what happens when conciliation fails. The ALRC recommends that conciliation will be taken to have failed where, in the opinion of the Commissioner, reasonable attempts to settle the complaint by conciliation have been made and the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation. This framework adopts language from industrial relations legislation, where conciliation and arbitration are well-established practices in resolving disputes.[84] State and territory privacy legislation also provides expressly for conciliation failing or being unsuccessful.[85] This amendment would, if implemented, provide clearer parameters in which to conduct conciliation.
49.63 Finally, the ALRC recommends that the Act should be amended to provide that, where the Commissioner is of the opinion that conciliation has failed, the Commissioner must notify the complainant and respondent of this conclusion and the complainant or respondent may require that the complaint be resolved by determination.
49.64 This recommendation is analogous to the provisions in the Information Privacy Act 2000 (Vic), where, if the Commissioner has attempted unsuccessfully to conciliate a complaint, he or she must notify the complainant and the respondent in writing, and the complainant may require the Commissioner to refer the complaint to the Victorian Civil and Administrative Tribunal for hearing.[86] It is also comparable to the approach in the Human Rights and Equal Opportunity Commission Act 1986 (Cth) where, if the President terminates a complaint on the basis that he or she is satisfied that there is no reasonable prospect of the matter being settled by conciliation, any person affected in relation to the complaint may make an application to the Federal Court or the Federal Magistrates Court alleging unlawful discrimination by the respondent.[87] The ALRC’s recommended model also is similar to the relationship between conciliation and arbitration in state industrial relations legislation.[88]
49.65 This recommendation, if implemented, should lead to an increase in the number of determinations issued by the OPC, which would help address concerns from stakeholders about the lack of jurisprudence on the Privacy Act.[89] The recommendation should increase public enforcement and awareness of the Act, which is consistent with Parliament’s expectation that the Commissioner ‘be the means by which there will be accountability to the public on the use by government of their personal information’.[90] It also is consistent with the legislative intention that determinations be issued where conciliation has failed. The presence of the power to request a determination should provide a real incentive for agencies and organisations to engage in the conciliation process, which some stakeholders suggest has been lost due to the very limited number of determinations issued. In addition, the ALRC is concerned that the conciliation process cannot properly occur under the Act where it is open to the Commissioner to close the complaint when it decides that the respondent has made an offer that adequately deals with the complaint.
49.66 Recommendation 45–13, below, will allow the Commissioner to make a determination without oral hearing where he or she believes the matter could be determined fairly on the basis of written submissions. This will mean that the determination process may be quicker and not as costly to parties and the OPC as it is under the current arrangements. It will not be as great a burden on the OPC, therefore, for a party to compel a determination where conciliation has failed.
49.67 There is some risk that providing a right to compel a determination may encourage vexatious litigants and add to the unreasonable expectations sometimes held by complainants about how a complaint will be resolved. The model recommended by the ALRC, however, incorporates adequate safeguards against vexatious and trivial conduct, as it operates only in relation to complaints that the Commissioner has not dismissed under s 41. That is, the complaint must have passed the threshold requirements of being in time; involving a possible breach; and not being frivolous, vexatious, misconceived or lacking in substance. The complaint, therefore, must have a degree of merit. The recommendation also requires the complainant and respondent to have made a genuine and concerted effort to conciliate the complaint.
49.68 Finally, the ALRC recommends that the Act should be amended to protect evidence produced in the conciliation process from being used in a determination hearing or later enforcement proceedings. This recommendation is based on a provision in the Victorian Information Privacy Act,[91] and is intended to encourage parties to engage in full and frank negotiations as part of conciliation. Where, however, the communication or evidence in issue was made in furtherance of the commission of a fraud or an offence, or in the commission of an act that would render a person liable to a civil penalty, the evidence should not be protected.[92]
49.69 Complainants should not have a right to request a determination if their complaint is dismissed. Given that many complaints are dismissed on the basis that they are trivial, frivolous, vexatious, lacking in substance or the Commissioner lacks jurisdiction, it would not be a feasible or a productive use of the OPC’s resources to require a determination (potentially) in each case.
Addressing systemic issues
49.70 The ALRC recognises the need for the Commissioner to be able to prescribe remedies that address systemic issues and effect systemic changes in agencies, organisations and industries. The ALRC recommends that the Commissioner’s determination powers under s 52 should be amended to empower the Commissioner to make a declaration in a determination that a respondent must take specified action within a specified period for the purpose of ensuring compliance with the Privacy Act.[93] The ability to prescribe how the respondent should act to comply with, for example, the model Uniform Privacy Principles (UPPs) should end the difficulty described by stakeholders of not knowing how to prevent future harm. It also should provide greater certainty to agencies, organisations and the public on what behaviour is consistent with the principles or regulations.[94]
49.71 While a determination may relate to an individual complaint, that individual complaint may itself be about a systemic issue. Empowering the Commissioner to prescribe remedies that are able to address systemic issues in the complaint-handling process allows the Commissioner to achieve maximum change from each determination.
49.72 It also should be noted that a declaration to take specified action to comply with the Privacy Act would be one of several declarations that the Commissioner can make as part of a determination under s 52.[95] As is the case with other determinations, it would not be binding or conclusive between parties.[96] A determination would be subject to merits review by the Administrative Appeals Tribunal (AAT).[97]
49.73 The ALRC does not agree that this recommendation is incompatible with outcomes-based or principles-based regulation. As noted in Chapter 4, a principles-based regime does not mean that agencies and organisations always will be left to find their own way of achieving compliance after an instance of non-compliance. In some instances, the particulars of the breach may demonstrate that the respondent is having trouble, either deliberately or in good faith, with finding its own way to achieving the desired outcome. In such circumstances, the appropriate enforcement response may be to prescribe the steps the respondent should take to achieve compliance with the principle. For example, the OPC would not tell a business what price it should set for access to information. It may, however, through its determination, direct an organisation to develop a price for access to information that is reasonable, having regard to whatever factors may be relevant in the circumstances.
Recommendation 49–4 The Privacy Act should be amended to clarify the Privacy Commissioner’s functions in relation to complaint handling and the process to be followed when a complaint is received.
Recommendation 49–5 The Privacy Act should be amended to include new provisions dealing expressly with conciliation. These provisions should give effect to the following:
(a) If, at any stage after accepting the complaint, the Commissioner considers it reasonably possible that the complaint may be conciliated successfully, he or she must make reasonable attempts to conciliate the complaint.
(b) Where, in the opinion of the Commissioner, reasonable attempts to settle the complaint by conciliation have been made and the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation, the Commissioner must notify the complainant and respondent that conciliation has failed and the complainant or respondent may require that the complaint be resolved by determination.
(c) Evidence of anything said or done in the course of a conciliation is not admissible in a determination hearing or any enforcement proceedings relating to the complaint, unless all parties to the conciliation otherwise agree.
(d) Subparagraph (c) does not apply where the communication was made in furtherance of the commission of a fraud or an offence, or in the commission of an act that would render a person liable to a civil penalty.
Recommendation 49–6 The Privacy Act should be amended to empower the Privacy Commissioner, in a determination, to prescribe the steps that an agency or respondent must take to ensure compliance with the Act.
[46]Privacy Act 1988 (Cth) ss 27(1)(a), 27(1)(ab).
[47] Ibid s 52.
[48] Ibid ss 27(1)(a), 27(1)(ab).
[49] See, eg, the conciliation provisions in Information Privacy Act 2000 (Vic) pt 5 div 3; Health Records Act 2001 (Vic) pt 6 div 3; Information Act 2002 (NT) ss 110–113 (in relation to mediation). See also the proposed provisions in Information Privacy Bill 2007 (WA) pt 5 div 2.
[50] See Office of the Privacy Commissioner, Privacy Complaints <www.privacy.gov.au/privacy_rights/
complaints/index.html> at 1 August 2007.
[51] Office of the Privacy Commissioner, The Operation of the Privacy Act Annual Report: 1 July 2006–30 June 2007 (2007), [3.3.1].
[52] Ibid, [3.3.2].
[53] Ibid, [3.3.2]. See also Table 3.5.
[54] This is summarised from Office of the Privacy Commissioner, Privacy Complaints <www.privacy.gov.
au/privacy_rights/complaints/index.html> at 1 August 2007.
[55]Privacy Act 1988 (Cth) s 52(1)(b)(i).
[56] Ibid s 52(1)(b)(ii). ‘Loss or damage’ is defined in s 52(1A).
[57] Ibid s 52(1)(b)(iii). The Privacy Act does not limit the monetary compensation that the Commissioner may award to a complainant: Australian Institute of Company Directors, Office of the Federal Privacy Commissioner and Information and Privacy Commissioner Ontario, Privacy and Boards: What You Don’t Know Can Hurt You (2004), 11; Rummery and Federal Privacy Commissioner [2004] AATA 1221, [26]–[29]. See s 52(4)–(6) in relation to compensation orders in representative complaints. The Commissioner also can make a declaration that the complainant is entitled to a specified amount as reimbursement for expenses reasonably incurred in connection with the complaint: Privacy Act 1988 (Cth)s 52(3).
[58]Privacy Act 1988 (Cth) s 52(1)(b)(iv).
[59] Ibid s 52(1B).
[60] C Saunders, ‘The Separation of Powers’ in B Opeskin and F Wheeler (eds), The Australian Federal Judicial System (2000) 3, 14, 15–16, 25. See, eg, Huddart, Parker & Co Pty Ltd v Moorehead (1909) 8 CLR 330, 357; Waterside Workers’ Federation of Australia v JW Alexander Ltd (1918) 25 CLR 434, 442; R v Kirby; Ex parte Boilermakers’ Society of Australia (1956) 94 CLR 254, 281–282; Brandy v Human Rights and Equal Opportunity Commission (1995) 183 CLR 245.
[61] Office of the Privacy Commissioner, Complaint Case Notes, Summaries and Determinations (2007) <www.privacy.gov.au/act/casenotes/index.html> at 15 May 2008.
[62] Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), recs 37, 42. See also the discussion at 139, 144.
[63] Office of the Privacy Commissioner, ‘Commissioner’s Use of s 52 Determination Power’ (2006) 1(1) Privacy Matters 2, 2.
[64] Ibid, 2.
[65] See Office of the Federal Privacy Commissioner, Complaint Determination No 1 of 2004, 1 April 2004. See also Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 136.
[66] Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), rec 44.
[67] Australian Government Attorney-General’s Department, Government Response to the Privacy Commissioner’s Report: Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2006), [Item 44].
[68] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), [45.38]–[45.50].
[69] Ibid, Proposal 45–4.
[70] Australian Bankers’ Association Inc, Submission PR 567, 11 February 2008; Australian Privacy Foundation, Submission PR 553, 2 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Australian Federal Police, Submission PR 545, 24 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007; Law Society of New South Wales, Submission PR 443, 10 December 2007.
[71] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 45–5.
[72] Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.
[73] Australian Government Department of Agriculture‚ Fisheries and Forestry, Submission PR 556, 7 January 2008; Australian Privacy Foundation, Submission PR 553, 2 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; GE Money Australia, Submission PR 537, 21 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; National Legal Aid, Submission PR 521, 21 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; Law Society of New South Wales, Submission PR 443, 10 December 2007; Australasian Compliance Institute, Submission PR 419, 7 December 2007.
[74] Public Interest Advocacy Centre, Submission PR 548, 26 December 2007.
[75] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.
[76] Confidential, Submission PR 536, 21 December 2007.
[77] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 45–6.
[78] Australian Bankers’ Association Inc, Submission PR 567, 11 February 2008; Australian Privacy Foundation, Submission PR 553, 2 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Veda Advantage, Submission PR 498, 20 December 2007; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007; Law Society of New South Wales, Submission PR 443, 10 December 2007; P Youngman, Submission PR 394, 7 December 2007.
[79] Telstra Corporation Limited, Submission PR 459, 11 December 2007.
[80] Commonwealth, Parliamentary Debates, House of Representatives, 1 November 1988, 2117 (L Bowen–Attorney-General). A similar description of the role of conciliation and determinations was given in Explanatory Memorandum, Privacy Bill 1988 (Cth), 3. Note determinations originally were automatically binding between parties, before the amendments made by the Law and Justice Amendment Act 1994 (Cth) and the Human Rights Legislation Amendment Act 1995 (Cth).
[81] Rec 5–2.
[82] Note there is precedent for a more open conciliation power in the Anti-Discrimination Act 1977 (NSW) s 91A, which provides that the President may ‘at any stage after acceptance of the complaint endeavour to resolve the complaint by conciliation’. The ability of the Commissioner to conciliate the complaint at any stage is also reflected in Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 45–5(a).
[83] See, eg, Information Privacy Act 2000 (Vic) s 33; Health Records Act 2001 (Vic) s 59. See also the precedent in Industrial Relations Act 1996 (NSW) s 109.
[84] See, eg, Industrial Relations Act 1996 (NSW) ss 134–135.
[85] See Information Privacy Act 2000 (Vic) s 37; Health Records Act 2001 (Vic) s 63; Information Act 2002 (NT) s 111.
[86]Information Privacy Act 2000 (Vic) s 37. See also Health Records Act 2001 (Vic) s 63; Information Act 2002 (NT) s 113.
[87]Human Rights and Equal Opportunity Act 1986 (Cth) ss 46PH(1)(i), 46PO.
[88] See, eg, Industrial Relations Act 1996 (NSW) s 135.
[89] The ALRC considers that there is greater jurisprudential value in determinations than in case notes of conciliated complaints.
[90] Commonwealth, Parliamentary Debates, House of Representatives, 1 November 1988, 2117 (L Bowen–Attorney-General). Note this speech only refers to the government, as organisations were not covered by the Privacy Act when the Act was originally passed.
[91] See Information Privacy Act 2000 (Vic) s 36.
[92] This exception is based on the exception to the general exclusion of evidence of settlement negotiations under s 131 of the Evidence Act 1995 (Cth).
[93] This wording is based on the compliance notice model used in other privacy legislation. See Information Privacy Act 2000 (Vic) s 44; Health Records Act 2001 (Vic) s 66; Information Act 2002 (NT) s 82.
[94] Greater certainty was requested by some residential tenancy database operators following the 2004 determinations: see Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 159.
[95] Other declarations that may be made under s 52(1) include declarations that the complainant is entitled to compensation for any loss or damage, or a declaration that the respondent should perform any reasonable act to redress any loss or damage suffered by the complainant.
[96] See s 52(1B).
[97] See Rec 49–7. The need for an appeal process was noted in one submission: Australian Federal Police, Submission PR 545, 24 December 2007.