Right to information and privacy complaints

The Information Privacy Act 2009 (IP Act) recognises the importance of protecting the personal information of individuals. It contains a set of rules or ‘privacy principles’ that govern how Queensland Government agencies collect, store, use and disclose personal information.

The IP Act allows an individual to make a complaint about an agency's breach of the privacy principles.

The privacy principles apply to all Queensland government agencies including departments, public authorities and local government. However, there are agencies that the principles do not apply to, which can be found here.

An individual can make a complaint if they believe a Queensland Government agency has breached its obligations under the IP Act to comply with the:

• privacy principles; and/or
• conditions attached to a public interest approval.

The Office of the Information Commissioner (OIC) is Queensland’s independent statutory body established to promote access to government-held information, and to protect people’s personal information held by the public sector.

If you are concerned that an agency has breached your privacy you can:

• make a complaint to that agency
• if you are not satisfied with the response, make a complaint to the OIC
• if a settlement cannot be reached in the complaint with the OIC, ask the OIC to refer the complaint to QCAT which has the power to consider the privacy complaint further

The Office of the Information Commissioner’s website provides detailed guides and information on the process you need to follow when you want to initially make a privacy complaint. You can learn more about the process to do so here.

For privacy complaints, you must make your complaint with the agency initially. If you are not satisfied with their response, you must make your complaint to the Office of the Information Commissioner (OIC) after this. If the complaint cannot be resolved through mediation, you can ask the OIC to refer your complaint to QCAT for further consideration.

QCAT is not the correct place to bring your initial privacy complaint.

You can only apply directly to QCAT when:

• seeking a review of decisions in relation to financial hardship status made by the OIC
• seeking a review of decisions in relation to vexatious applicant declarations under the Right to Information Act 2009 and Information Privacy Act 2009
• seeking a review of decisions in relation to compliance notices under the Information Privacy Act 2009

To seek a review of these decisions please see our review of government agency decisions page here.

You can also only apply directly to QCAT when:

• seeking to directly appeal a decision made by the Information Commissioner about your privacy complaint on a question of law at QCAT’s Appeal Tribunal.

The process to appeal a decision is outlined below when you apply.

After the hearing of a referred privacy complaint, QCAT may make one or more of the following orders:

• an order that the complaint, or a part of the complaint, has been substantiated, including orders;
  • not to repeat or continue the act or practice;
  • to engage in a stated reasonable act or practice to compensate for loss or damage suffered by the complainant;
  • to make an apology to the complainant;
  • to make stated amendments of documents held; or
  • for compensation of not more than $100,000,
• that no further action is required to be taken;
• to dismiss the complaint; or
• to reimburse for expenses reasonably incurred in connection with making the complaint.

_{(For full description and details please see the Information Privacy Act 2009)}

In deciding privacy appeals on a question of law, the QCAT Appeal Tribunal may decide to:

• confirm or amend a decision; or
• set aside a decision and substitute it with its own decision; or
• set aside a decision and return the matter to the Information Commissioner to reconsider it; or
• make any other appropriate orders.

Leave (permission) to appeal a privacy decision by the Information Commissioner is not required when applying to the QCAT Appeal Tribunal on a question of law.

The OIC refers privacy complaints to QCAT if they cannot be resolved by the parties through mediation. The individual complainant and the agency will be the parties to the hearing before QCAT.

If the OIC has referred the complaint, a copy of the referral will be sent to each party to the dispute by QCAT.

After a referral is made by the OIC, QCAT may:

• issue directions to the parties. Directions are instructions to the parties involved on how the matter will proceed. The directions will include time for filing of evidence, other material and joining of further parties if required
• list the matter for a directions hearing or further dispute resolution proceeding to assist the parties to reach agreement if required
• ask the parties to gather and file their evidence to support their side of the argument
• list the matter for a hearing, after the parties have filed their evidence; and
• after the hearing, QCAT will then make a final decision based on the law and the evidence provided by the parties

Whether you are the complainant or respondent in the complaint referral, once the complaint is referred you do not need to do anything further and should wait for further instructions to be issued by QCAT.