{"id":"F2001B00356","name":"Privacy (Private Sector) Regulations 2001","slug":"privacy-private-sector-regulations-2001","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"repealed","isInForce":false,"actNumber":"266 of 2001","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":31001,"registerId":"commonwealth-F2001B00356-current","compilationNumber":null,"startDate":"2026-04-01","status":"Repealed","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"## Part 1—Preliminary","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Name of Regulations","content":"#### 1 Name of Regulations\n\n  These Regulations are the Privacy (Private Sector) Regulations 2001.","sortOrder":1},{"sectionNumber":"2","sectionType":"section","heading":"Commencement","content":"#### 2 Commencement\n\n  These Regulations commence on the commencement of Schedule 1 to the Privacy Amendment (Private Sector) Act 2000.","sortOrder":2},{"sectionNumber":"3","sectionType":"section","heading":"Definition","content":"#### 3 Definition\n\n  In these Regulations, unless the contrary intention appears:\n\n> Act means the Privacy Act 1988.","sortOrder":3},{"sectionNumber":"3AA","sectionType":"section","heading":"Small business operators treated as organisations (Act s 6E)","content":"#### 3AA Small business operators treated as organisations (Act s 6E)\n\n  (1) For subsection 6E(2) of the Act, a small business operator that operates a residential tenancy database is prescribed.\n  (2) For subsection 6E(2) of the Act, the following acts or practices of a small business operator of the kind mentioned in subregulation (1) are prescribed:\n    (a) an act done, or a practice engaged in, in connection with collecting personal information for the purpose of establishing or maintaining a residential tenancy database;\n    (b) an act done, or a practice engaged in, in connection with maintaining personal information on a residential tenancy database;\n    (c) an act done, or a practice engaged in, in connection with using or disclosing personal information that is stored on a residential tenancy database.\n  (3) In this regulation:\n\n> residential tenancy database means a database:\n\n    (a) that stores personal information in relation to an individual’s occupation of residential premises as a tenant; and\n    (b) that can be accessed by a person other than the operator of the database or a person acting for the operator.","sortOrder":4},{"sectionNumber":"3A","sectionType":"section","heading":"State authorities treated as organisations (Act s 6F)","content":"#### 3A State authorities treated as organisations (Act s 6F)\n\n  For section 6F of the Act, the following authorities of New South Wales are prescribed:\n    (a) Australian Inland Energy Water Infrastructure;\n    (b) Country Energy;\n    (c) EnergyAustralia;\n    (d) Integral Energy Australia.","sortOrder":5},{"sectionNumber":"4","sectionType":"section","heading":"Agencies to be treated as organisations (Act s 7A)","content":"#### 4 Agencies to be treated as organisations (Act s 7A)\n\n  For subsection 7A(2) of the Act, the following agencies are prescribed:\n    (a) Australian Government Solicitor;\n    (b) Australian Industry Development Corporation.","sortOrder":6},{"sectionNumber":"Part 2","sectionType":"part","heading":"Privacy Codes","content":"## Part 2—Privacy Codes","sortOrder":7},{"sectionNumber":"5","sectionType":"section","heading":"Procedures relating to complaints—prescribed standards (Act s 18BB)","content":"#### 5 Procedures relating to complaints—prescribed standards (Act s 18BB)\n\n  For subparagraph 18BB(3)(a)(i) of the Act, the prescribed standards are the standards set out in Schedule 1.\n\n> Note: Section 18BB of the Act deals with the approval by the Commissioner of privacy codes. Under subsection 18BB(3), a privacy code that sets out procedures for making and dealing with complaints may not be approved by the Commissioner unless the Commissioner is satisfied of the matters set out in that subsection, including, under subparagraph (a)(i), that the procedures meet the prescribed standards.","sortOrder":8},{"sectionNumber":"Part 3","sectionType":"part","heading":"National Privacy Principles","content":"## Part 3—National Privacy Principles","sortOrder":9},{"sectionNumber":"6","sectionType":"section","heading":"Definitions for Part 3","content":"#### 6 Definitions for Part 3\n\n  In this Part:\n\n> agency means an agency, as defined in subsection 6(1) of the Act, and specified in Schedule 2, in relation to which the Minister is satisfied that the events mentioned in paragraphs 100(2)(a) and (b) of the Act have occurred.\n\n> AGEST means the Australian Government Employees Superannuation Trust (including a payroll contractor of that organisation).\n\n> AvSuper means AvSuper Pty Ltd (including a payroll contractor of AvSuper Pty Ltd).\n\n> Centrelink means the Commonwealth Services Delivery Agency that was established by the Commonwealth Services Delivery Agency Act 1997.\n\n> Note: The Agency was abolished on 1 July 2011 by the Human Services Legislation Amendment Act 2011.\n\n> centrelink program has the meaning given by section 40 of the Human Services (Centrelink) Act 1997.\n\n> Customer Reference Number means the number assigned to an individual by Centrelink, or by the Department of Human Services in relation to centrelink programs.\n\n> DVA File Number means the file number assigned to an individual by the Department of Veterans’ Affairs.\n\n> payroll contractor, of an organisation (the principal organisation), means an organisation that is responsible, under a contract, for processing, on behalf of the principal organisation, any payments received by, or on behalf of, the principal organisation from an agency, its agent or its contracted service provider for the benefit of an individual employed, or formerly employed, by the agency.\n\n> payroll number, assigned to an individual by an agency, means the identifier assigned to the individual by the agency, its agent or its contracted service provider for the purpose of providing salary and other employment benefits to the individual.","sortOrder":10},{"sectionNumber":"7","sectionType":"section","heading":"Exceptions to National Privacy Principle 7.1","content":"#### 7 Exceptions to National Privacy Principle 7.1\n\n  For subclause 7.1A of the National Privacy Principles:\n    (a) AvSuper is a prescribed organisation; and\n    (b) the payroll number assigned to an individual by Airservices Australia or the Civil Aviation Safety Authority is a prescribed identifier; and\n    (c) the prescribed circumstance is that the payroll number is adopted by AvSuper to provide a superannuation service to the individual.","sortOrder":11},{"sectionNumber":"8","sectionType":"section","heading":"Exceptions to National Privacy Principle 7.2","content":"#### 8 Exceptions to National Privacy Principle 7.2\n\n  For paragraph 7.2(c) of the National Privacy Principles:\n    (a) AGEST and AvSuper are each a prescribed organisation; and\n    (b) the payroll number assigned to an individual by an agency is a prescribed identifier; and\n    (c) the prescribed circumstance is that the payroll number is used or disclosed by AGEST or AvSuper to provide a superannuation service to the individual.","sortOrder":12},{"sectionNumber":"9","sectionType":"section","heading":"Exceptions to National Privacy Principle 7.2—Centrelink Confirmation eServices (Customer Confirmation)","content":"#### 9 Exceptions to National Privacy Principle 7.2—Centrelink Confirmation eServices (Customer Confirmation)\n\n  Customer Reference Number\n  (1) For paragraph 7.2(c) of the National Privacy Principles:\n    (a) an organisation mentioned in Part 1 of Schedule 3 is a prescribed organisation; and\n    (b) a Customer Reference Number is a prescribed identifier; and\n    (c) the prescribed circumstance is that the Customer Reference Number is used or disclosed by a prescribed organisation mentioned in Part 1 of Schedule 3, with the consent of the individual concerned, to access Centrelink Confirmation eServices for the purpose of making a Customer Confirmation enquiry to determine whether the individual is entitled to receive a concession.\n  DVA File Number\n  (2) For paragraph 7.2(c) of the National Privacy Principles:\n    (a) an organisation mentioned in Part 2 of Schedule 3 is a prescribed organisation; and\n    (b) a DVA File Number is a prescribed identifier; and\n    (c) the prescribed circumstance is that a DVA File Number is used or disclosed by a prescribed organisation mentioned in Part 2 of Schedule 3, with the consent of the individual concerned, to access Centrelink Confirmation eServices for the purpose of making a Customer Confirmation enquiry to determine whether the individual is entitled to receive a concession.","sortOrder":13},{"sectionNumber":"10","sectionType":"section","heading":"Exceptions to National Privacy Principle 7.2—Centrelink Confirmation eServices (Income Confirmation)","content":"#### 10 Exceptions to National Privacy Principle 7.2—Centrelink Confirmation eServices (Income Confirmation)\n\n  For paragraph 7.2(c) of the National Privacy Principles:\n    (a) an organisation mentioned in Schedule 4 is a prescribed organisation; and\n    (b) a Customer Reference Number is a prescribed identifier; and\n    (c) the prescribed circumstance is that the Customer Reference Number is used or disclosed by a prescribed organisation mentioned in Schedule 4, with the consent of the individual concerned, to access Centrelink Confirmation eServices for the purpose of making an Income Confirmation enquiry to determine whether the individual is entitled to receive a service or assistance.","sortOrder":14},{"sectionNumber":"11","sectionType":"section","heading":"Exceptions to National Privacy Principle 7.2—Centrelink Confirmation eServices (Superannuation Confirmation)","content":"#### 11 Exceptions to National Privacy Principle 7.2—Centrelink Confirmation eServices (Superannuation Confirmation)\n\n  For paragraph 7.2(c) of the National Privacy Principles:\n    (a) an organisation mentioned in Schedule 5 is a prescribed organisation; and\n    (b) a Customer Reference Number is a prescribed identifier; and\n    (c) the prescribed circumstance is that the Customer Reference Number is used or disclosed by a prescribed organisation mentioned in Schedule 5, with the consent of the individual concerned, to access Centrelink Confirmation eServices for the purpose of making a Superannuation Confirmation enquiry to assist in determining whether the individual is entitled to the early release of superannuation on the ground of financial hardship.","sortOrder":15},{"sectionNumber":"Part 4","sectionType":"part","heading":"Privacy Advisory Committee","content":"## Part 4—Privacy Advisory Committee","sortOrder":16},{"sectionNumber":"12","sectionType":"section","heading":"Travelling allowance—within Australia","content":"#### 12 Travelling allowance—within Australia\n\n  For section 88 of the Act, the travelling allowance payable to an appointed member is:\n    (a) the amount that would be payable to the member if clause 3.3 of the Remuneration Tribunal Determination 2004/03 applied; or\n    (b) the amount that would be payable to the member if clause 3.4 of the Remuneration Tribunal Determination 2004/03 applied, at the tier 2 rate.","sortOrder":17},{"sectionNumber":"1.1","sectionType":"section","heading":"Object","content":"#### 1.1 Object\n\n  (1) This Schedule sets out the standards that must be met by complaint‑handling procedures that are set out in a privacy code.\n  (2) The standards apply to complaints that are made to an independent adjudicator who is appointed under the code.","sortOrder":19},{"sectionNumber":"1.2","sectionType":"section","heading":"Definitions","content":"#### 1.2 Definitions\n\n  In this Schedule, unless the contrary intention appears:\n\n> complaint means a complaint that is made by an individual about an act or practice of an organisation that may be an interference with the privacy of the individual.\n\n> independent adjudicator means the person who is appointed under a privacy code as an independent person to whom a complaint may be made.\n\n> Note: The Australian Information Commissioner may be appointed as an independent adjudicator under a privacy code.\n\n> participating organisation, in relation to a privacy code, means an organisation that is bound by the code.\n\n> respondent organisation, in relation to a complaint, means the participating organisation against whom the complaint is made.","sortOrder":20},{"sectionNumber":"2.1","sectionType":"section","heading":"Overview","content":"#### 2.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must:\n     be readily available to any individual about whom a participating organisation holds personal information;\n     be promoted widely;\n     be easy to use;\n     be able to be used by complainants without any charge or fee.\n\nPurpose\n\n  The purpose of this Part is to ensure that complaint‑handling procedures are accessible, on an equitable basis, to any individual about whom a participating organisation holds personal information.","sortOrder":22},{"sectionNumber":"2.2","sectionType":"section","heading":"Procedures to be in writing","content":"#### 2.2 Procedures to be in writing\n\n  (1) The complaint‑handling procedures must be in writing.\n  (2) The procedures must be clearly expressed and must deal with the following matters:\n    (a) how to make a complaint;\n    (b) how a complaint will be dealt with;\n    (c) the kind of complaints that can be dealt with under the procedures;\n    (d) any restrictions on the kind of complaints that can be dealt with under the procedures.","sortOrder":23},{"sectionNumber":"2.3","sectionType":"section","heading":"Awareness and promotion","content":"#### 2.3 Awareness and promotion\n\n  (1) The existence of the complaint‑handling procedures must be promoted as widely as possible to the class or classes of individuals to whom it is relevant, using news media or any other appropriate means.\n  (2) The methods used for promoting the existence of the procedures must be appropriate for all individuals, and, in particular, must be sensitive to the needs of individuals with disabilities and disadvantaged individuals (for example, those who cannot read or write).","sortOrder":24},{"sectionNumber":"2.4","sectionType":"section","heading":"Copies of procedures to be made available","content":"#### 2.4 Copies of procedures to be made available\n\n  (1) A copy of the complaint‑handling procedures must be readily available:\n    (a) to a complainant, as soon as practicable after the complaint is made; and\n    (b) to anyone else who asks for it.\n  (2) The procedures must ensure that a participating organisation is compelled to give a copy of the complaint‑handling procedures to an individual if:\n    (a) the individual has complained to the organisation about an act or practice of the organisation that may be an interference with the privacy of the individual; and\n    (b) any of the following occurs:\n    (i) the complaint is dealt with in accordance with the organisation’s internal complaints mechanism (whether or not the individual is satisfied with the outcome);\n    (ii) the organisation refuses to deal with the complaint;\n    (iii) the organisation does not deal with the complaint in the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, or in accordance with the organisation’s internal complaints mechanism.\n  (3) If an organisation is required to give a copy of the complaint‑handling procedures to an individual under subclause (2), the organisation must give the copy to the individual, as the case requires:\n    (a) when the individual’s complaint has been dealt with; or\n    (b) when the decision to refuse to deal with the individual’s complaint is made; or\n    (c) at the end of the time when the individual’s complaint should have been dealt with.","sortOrder":25},{"sectionNumber":"2.5","sectionType":"section","heading":"Access to procedures","content":"#### 2.5 Access to procedures\n\n  (1) The complaint‑handling procedures must be accessible to any individual about whom a participating organisation holds personal information, regardless of where the individual is located.\n\n> Note: Example: Access to the complaint‑handling procedures may be provided by a toll‑free telephone service or by sending a copy of the procedures to an individual.\n\n  (2) The procedures must ensure that appropriate facilities and assistance are provided for individuals with disabilities and disadvantaged individuals.\n  (3) The procedures must ensure that an individual may contact a participating organisation in relation to a possible complaint orally or in writing.\n  (4) The procedures must require a complaint to be made in writing.\n\n> Note: Appropriately trained staff must, if necessary, assist a complainant to prepare a complaint in writing—see subclause 2.7(3) of this Schedule.","sortOrder":26},{"sectionNumber":"2.6","sectionType":"section","heading":"Cost","content":"#### 2.6 Cost\n\n  A complainant must not be charged a fee for making a complaint or having a complaint dealt with.","sortOrder":27},{"sectionNumber":"2.7","sectionType":"section","heading":"Complaint‑handling staff","content":"#### 2.7 Complaint‑handling staff\n\n  (1) A complaint must be handled by staff with the appropriate ability and training.\n  (2) The complaint‑handling staff must explain the following matters to a complainant as simply as possible:\n    (a) how a complaint will be dealt with;\n    (b) the matters that will be dealt with in relation to a complaint;\n    (c) any restrictions on the matters that will be dealt with in relation to a complaint;\n    (d) the expected time needed for each process to be carried out in dealing with the complaint.\n  (3) The complaint‑handling staff must assist a complainant to prepare a written complaint if the complainant needs such assistance.","sortOrder":28},{"sectionNumber":"2.8","sectionType":"section","heading":"Methods for dealing with complaints","content":"#### 2.8 Methods for dealing with complaints\n\n  (1) The complaint‑handling procedures must be as simple as possible for complainants to understand and use.\n  (2) In particular, a complaint must be dealt with:\n    (a) using appropriate methods and techniques (including conciliation, mediation and negotiation); and\n    (b) with as little formality and technicality, and with as much expedition, as a proper consideration of the complaint permits.","sortOrder":29},{"sectionNumber":"2.9","sectionType":"section","heading":"Presentation of complainant’s case","content":"#### 2.9 Presentation of complainant’s case\n\n  (1) The independent adjudicator must decide whether the complainant’s case in relation to the complaint is to be presented orally or in writing.\n  (2) The adjudicator must permit another person to support the complainant at any time while the complaint is being dealt with.","sortOrder":30},{"sectionNumber":"2.10","sectionType":"section","heading":"Representation of complainant by legal practitioner","content":"#### 2.10 Representation of complainant by legal practitioner\n\n  (1) The complainant, or the respondent organisation, may be represented by a legal practitioner only if:\n    (a) the complainant or respondent organisation makes a request to the adjudicator to be legally represented; and\n    (b) the adjudicator considers that special circumstances exist in relation to the complaint.\n  (2) If either party, being the complainant or the respondent organisation, is represented by a legal practitioner, the other party may also be represented by a legal practitioner.\n  (3) If:\n    (a) the respondent organisation requests that it be represented by a legal practitioner; and\n    (b) after that request, the complainant requests that he or she be represented by a legal practitioner; and\n    (c) the adjudicator grants both requests;\n  the respondent organisation must pay the complainant’s legal costs.","sortOrder":31},{"sectionNumber":"3.1","sectionType":"section","heading":"Overview","content":"#### 3.1 Overview\n\nPrinciple\n\n  The administration of, and process of making determinations under, the complaint‑handling procedures must be independent from all participating organisations.\n\nPurpose\n\n  The purpose of this Part is to ensure that all processes carried out under the complaint‑handling procedures, and all determinations made under the procedures, are carried out or made in an objective and unbiased way and are seen to be carried out, or made, in an objective and unbiased way.","sortOrder":33},{"sectionNumber":"3.2","sectionType":"section","heading":"Independent adjudicator","content":"#### 3.2 Independent adjudicator\n\n  (1) A person who is appointed as an independent adjudicator under a privacy code must be appointed for a fixed term.\n  (2) An adjudicator for a privacy code must not be selected directly by any organisation that is bound by that code.\n  (3) An adjudicator must not be answerable to any participating organisation in relation to his or her determinations, except as otherwise provided by the standards set out in this Schedule.\n  (4) An adjudicator must not have any relationship with any participating organisation that could give rise to a perceived or actual conflict of interest in relation to the performance of the adjudicator’s functions.","sortOrder":34},{"sectionNumber":"3.3","sectionType":"section","heading":"Complaint‑handling staff","content":"#### 3.3 Complaint‑handling staff\n\n  (1) The complaint‑handling staff for a privacy code must not be selected directly by any organisation that is bound by that code.\n  (2) The complaint‑handling staff must not be answerable to any participating organisation in relation to the operation of the complaint‑handling procedures, except as otherwise provided by the standards set out in this Schedule.","sortOrder":35},{"sectionNumber":"3.4","sectionType":"section","heading":"Overseeing entity","content":"#### 3.4 Overseeing entity\n\n  (1) The complaint‑handling procedures must ensure that the operation of the procedures is formally overseen by an overseeing entity consisting of as many members as are appropriate to provide a balance of representation of the interests of the following groups:\n    (a) the class or classes of individuals to whom the procedures are relevant (the relevant individuals);\n    (b) the relevant industry;\n    (c) if appropriate, other relevant stakeholders.\n  (2) A person who is appointed as a member of the overseeing entity to represent the interests of the relevant individuals must be a person:\n    (a) who is capable of reflecting the views and concerns of the relevant individuals; and\n    (b) in whom the relevant individuals and any relevant organisations have confidence.\n  (3) The procedures must ensure that the overseeing entity has the following functions:\n    (a) to appoint or dismiss an independent adjudicator under the relevant privacy code;\n    (b) to make recommendations in relation to, and approve, the budget for the operation of the procedures.","sortOrder":36},{"sectionNumber":"3.5","sectionType":"section","heading":"Funding","content":"#### 3.5 Funding\n\n  The participating organisations must ensure that sufficient funding is made available to enable complaints to be dealt with under the complaint‑handling procedures in accordance with:\n    (a) the standards set out in this Schedule; and\n    (b) the Privacy Act 1988; and\n    (c) any guidelines made by the Commissioner under paragraph 18BF(1)(b) of that Act.","sortOrder":37},{"sectionNumber":"4.1","sectionType":"section","heading":"Overview","content":"#### 4.1 Overview\n\nPrinciple\n\n  Determinations made under complaint‑handling procedures must be fair, and must be seen to be fair, and therefore:\n     investigations of complaints must be conducted with procedural fairness;\n     determinations must be made on the basis of information before an independent adjudicator;\n     determinations must be made on the basis of specific criteria.\n\nPurpose\n\n  The purpose of this Part is to ensure that determinations made under complaint‑handling procedures are fair and are seen to be fair.","sortOrder":39},{"sectionNumber":"4.2","sectionType":"section","heading":"Complainant to be informed of rights","content":"#### 4.2 Complainant to be informed of rights\n\n  The complaint‑handling staff for a privacy code must inform a complainant of his or her rights under the code and the Privacy Act 1988 in relation to:\n    (a) a decision that is made by the complaint‑handling staff in dealing with the complaint; or\n    (b) a determination of an independent adjudicator.\n\n> Note: See section 18BI of the Act, which provides for review by the Commissioner of an independent adjudicator’s determination, and section 55A of the Act, which provides for a proceeding to be commenced in the Federal Court or the Federal Circuit Court for an order to enforce a determination.","sortOrder":40},{"sectionNumber":"4.3","sectionType":"section","heading":"Investigation to be conducted with procedural fairness","content":"#### 4.3 Investigation to be conducted with procedural fairness\n\n  (1) An investigation of a complaint must be conducted with procedural fairness.\n  (2) In particular, each party to the complaint, being the complainant and the respondent organisation, must:\n    (a) be given sufficient information about the case being presented by the other party; and\n    (b) be given a reasonable opportunity to be heard and to respond to anything raised by the other party.","sortOrder":41},{"sectionNumber":"4.4","sectionType":"section","heading":"Power of adjudicator to obtain information or documents","content":"#### 4.4 Power of adjudicator to obtain information or documents\n\n  (1) If an independent adjudicator has reason to believe that a complainant has information or a document relevant to an investigation of a complaint:\n    (a) the adjudicator may give the complainant a written notice requesting the complainant to give the information or document to the adjudicator; and\n    (b) the complainant may, but must not be compelled to, give the information or document to the adjudicator.\n  (2) If an independent adjudicator has reason to believe that a participating organisation has information or a document relevant to an investigation of a complaint:\n    (a) the adjudicator may give the organisation a written notice requesting the organisation to give the information or document to the adjudicator; and\n    (b) subject to subclauses (3) and (4), the organisation must give the information or document to the adjudicator.\n  (3) A participating organisation is not required to give information, or a document, that contains identifying material about a third party to the adjudicator unless the third party has given permission for the information or document to be given to the adjudicator (whether in full or with the identifying material deleted or otherwise removed).\n  (4) A participating organisation is not required to give information or a document to the adjudicator if the organisation is prohibited under a law of the Commonwealth, or of a State or Territory, from disclosing the information or the contents of the document.\n  (5) If a participating organisation gives information, or a document, that contains identifying material about a third party to the adjudicator, the information or document may, at the discretion of the adjudicator, be given to the complainant with the identifying material deleted or otherwise removed.\n  (6) In this clause:\n\n> third party, in relation to a complaint, means a person, other than the complainant or the respondent organisation to the complaint, to whom the respondent organisation owes a duty of confidentiality or privacy.","sortOrder":42},{"sectionNumber":"4.5","sectionType":"section","heading":"Determinations of independent adjudicator","content":"#### 4.5 Determinations of independent adjudicator\n\n  (1) A determination made by an independent adjudicator in relation to a complaint must be fair and reasonable, having regard to the following:\n    (a) good industry practice;\n    (b) any relevant industry code of practice;\n    (c) the privacy code under which the adjudicator was appointed;\n    (d) any previous determinations made in relation to similar complaints;\n    (e) any relevant law.\n\n> Note: The determinations, findings, declarations, orders and directions that the adjudicator may make under the relevant privacy code after investigating a complaint are the same as those that the Commissioner may make under section 52 of the Act after investigating a complaint under the Act—see paragraph 18BB(3)(d) of the Act.\n\n  (2) As soon as practicable after making a determination in relation to a complaint, an independent adjudicator must inform the complainant and the respondent organisation of the determination and the reasons for the determination.","sortOrder":43},{"sectionNumber":"4.6","sectionType":"section","heading":"Confidentiality","content":"#### 4.6 Confidentiality\n\n  (1) Any information or document that is provided to an independent adjudicator for the purpose of investigating a complaint must be kept confidential, unless the information or document is required to be disclosed under a law of the Commonwealth, or of a State or Territory, or under any other standard set out in this Schedule.\n  (2) The procedures must ensure that the complainant and the respondent organisation undertake not to disclose any information that is gained in the course of having a complaint dealt with (for example, during any mediation, conciliation or negotiation), unless the information is required to be disclosed under a law of the Commonwealth, or of a State or Territory.","sortOrder":44},{"sectionNumber":"Part 5","sectionType":"part","heading":"Accountability","content":"Schedule 1—Privacy codes—prescribed standards for procedures relating to complaints\n\n(regulation 5)\n\n## Part 1—General\n\n#### 1.1 Object\n\n  (1) This Schedule sets out the standards that must be met by complaint‑handling procedures that are set out in a privacy code.\n  (2) The standards apply to complaints that are made to an independent adjudicator who is appointed under the code.\n\n#### 1.2 Definitions\n\n  In this Schedule, unless the contrary intention appears:\n\n> complaint means a complaint that is made by an individual about an act or practice of an organisation that may be an interference with the privacy of the individual.\n\n> independent adjudicator means the person who is appointed under a privacy code as an independent person to whom a complaint may be made.\n\n> Note: The Australian Information Commissioner may be appointed as an independent adjudicator under a privacy code.\n\n> participating organisation, in relation to a privacy code, means an organisation that is bound by the code.\n\n> respondent organisation, in relation to a complaint, means the participating organisation against whom the complaint is made.\n\n## Part 2—Accessibility\n\n#### 2.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must:\n     be readily available to any individual about whom a participating organisation holds personal information;\n     be promoted widely;\n     be easy to use;\n     be able to be used by complainants without any charge or fee.\n\nPurpose\n\n  The purpose of this Part is to ensure that complaint‑handling procedures are accessible, on an equitable basis, to any individual about whom a participating organisation holds personal information.\n\n#### 2.2 Procedures to be in writing\n\n  (1) The complaint‑handling procedures must be in writing.\n  (2) The procedures must be clearly expressed and must deal with the following matters:\n    (a) how to make a complaint;\n    (b) how a complaint will be dealt with;\n    (c) the kind of complaints that can be dealt with under the procedures;\n    (d) any restrictions on the kind of complaints that can be dealt with under the procedures.\n\n#### 2.3 Awareness and promotion\n\n  (1) The existence of the complaint‑handling procedures must be promoted as widely as possible to the class or classes of individuals to whom it is relevant, using news media or any other appropriate means.\n  (2) The methods used for promoting the existence of the procedures must be appropriate for all individuals, and, in particular, must be sensitive to the needs of individuals with disabilities and disadvantaged individuals (for example, those who cannot read or write).\n\n#### 2.4 Copies of procedures to be made available\n\n  (1) A copy of the complaint‑handling procedures must be readily available:\n    (a) to a complainant, as soon as practicable after the complaint is made; and\n    (b) to anyone else who asks for it.\n  (2) The procedures must ensure that a participating organisation is compelled to give a copy of the complaint‑handling procedures to an individual if:\n    (a) the individual has complained to the organisation about an act or practice of the organisation that may be an interference with the privacy of the individual; and\n    (b) any of the following occurs:\n    (i) the complaint is dealt with in accordance with the organisation’s internal complaints mechanism (whether or not the individual is satisfied with the outcome);\n    (ii) the organisation refuses to deal with the complaint;\n    (iii) the organisation does not deal with the complaint in the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, or in accordance with the organisation’s internal complaints mechanism.\n  (3) If an organisation is required to give a copy of the complaint‑handling procedures to an individual under subclause (2), the organisation must give the copy to the individual, as the case requires:\n    (a) when the individual’s complaint has been dealt with; or\n    (b) when the decision to refuse to deal with the individual’s complaint is made; or\n    (c) at the end of the time when the individual’s complaint should have been dealt with.\n\n#### 2.5 Access to procedures\n\n  (1) The complaint‑handling procedures must be accessible to any individual about whom a participating organisation holds personal information, regardless of where the individual is located.\n\n> Note: Example: Access to the complaint‑handling procedures may be provided by a toll‑free telephone service or by sending a copy of the procedures to an individual.\n\n  (2) The procedures must ensure that appropriate facilities and assistance are provided for individuals with disabilities and disadvantaged individuals.\n  (3) The procedures must ensure that an individual may contact a participating organisation in relation to a possible complaint orally or in writing.\n  (4) The procedures must require a complaint to be made in writing.\n\n> Note: Appropriately trained staff must, if necessary, assist a complainant to prepare a complaint in writing—see subclause 2.7(3) of this Schedule.\n\n#### 2.6 Cost\n\n  A complainant must not be charged a fee for making a complaint or having a complaint dealt with.\n\n#### 2.7 Complaint‑handling staff\n\n  (1) A complaint must be handled by staff with the appropriate ability and training.\n  (2) The complaint‑handling staff must explain the following matters to a complainant as simply as possible:\n    (a) how a complaint will be dealt with;\n    (b) the matters that will be dealt with in relation to a complaint;\n    (c) any restrictions on the matters that will be dealt with in relation to a complaint;\n    (d) the expected time needed for each process to be carried out in dealing with the complaint.\n  (3) The complaint‑handling staff must assist a complainant to prepare a written complaint if the complainant needs such assistance.\n\n#### 2.8 Methods for dealing with complaints\n\n  (1) The complaint‑handling procedures must be as simple as possible for complainants to understand and use.\n  (2) In particular, a complaint must be dealt with:\n    (a) using appropriate methods and techniques (including conciliation, mediation and negotiation); and\n    (b) with as little formality and technicality, and with as much expedition, as a proper consideration of the complaint permits.\n\n#### 2.9 Presentation of complainant’s case\n\n  (1) The independent adjudicator must decide whether the complainant’s case in relation to the complaint is to be presented orally or in writing.\n  (2) The adjudicator must permit another person to support the complainant at any time while the complaint is being dealt with.\n\n#### 2.10 Representation of complainant by legal practitioner\n\n  (1) The complainant, or the respondent organisation, may be represented by a legal practitioner only if:\n    (a) the complainant or respondent organisation makes a request to the adjudicator to be legally represented; and\n    (b) the adjudicator considers that special circumstances exist in relation to the complaint.\n  (2) If either party, being the complainant or the respondent organisation, is represented by a legal practitioner, the other party may also be represented by a legal practitioner.\n  (3) If:\n    (a) the respondent organisation requests that it be represented by a legal practitioner; and\n    (b) after that request, the complainant requests that he or she be represented by a legal practitioner; and\n    (c) the adjudicator grants both requests;\n  the respondent organisation must pay the complainant’s legal costs.\n\n## Part 3—Independence\n\n#### 3.1 Overview\n\nPrinciple\n\n  The administration of, and process of making determinations under, the complaint‑handling procedures must be independent from all participating organisations.\n\nPurpose\n\n  The purpose of this Part is to ensure that all processes carried out under the complaint‑handling procedures, and all determinations made under the procedures, are carried out or made in an objective and unbiased way and are seen to be carried out, or made, in an objective and unbiased way.\n\n#### 3.2 Independent adjudicator\n\n  (1) A person who is appointed as an independent adjudicator under a privacy code must be appointed for a fixed term.\n  (2) An adjudicator for a privacy code must not be selected directly by any organisation that is bound by that code.\n  (3) An adjudicator must not be answerable to any participating organisation in relation to his or her determinations, except as otherwise provided by the standards set out in this Schedule.\n  (4) An adjudicator must not have any relationship with any participating organisation that could give rise to a perceived or actual conflict of interest in relation to the performance of the adjudicator’s functions.\n\n#### 3.3 Complaint‑handling staff\n\n  (1) The complaint‑handling staff for a privacy code must not be selected directly by any organisation that is bound by that code.\n  (2) The complaint‑handling staff must not be answerable to any participating organisation in relation to the operation of the complaint‑handling procedures, except as otherwise provided by the standards set out in this Schedule.\n\n#### 3.4 Overseeing entity\n\n  (1) The complaint‑handling procedures must ensure that the operation of the procedures is formally overseen by an overseeing entity consisting of as many members as are appropriate to provide a balance of representation of the interests of the following groups:\n    (a) the class or classes of individuals to whom the procedures are relevant (the relevant individuals);\n    (b) the relevant industry;\n    (c) if appropriate, other relevant stakeholders.\n  (2) A person who is appointed as a member of the overseeing entity to represent the interests of the relevant individuals must be a person:\n    (a) who is capable of reflecting the views and concerns of the relevant individuals; and\n    (b) in whom the relevant individuals and any relevant organisations have confidence.\n  (3) The procedures must ensure that the overseeing entity has the following functions:\n    (a) to appoint or dismiss an independent adjudicator under the relevant privacy code;\n    (b) to make recommendations in relation to, and approve, the budget for the operation of the procedures.\n\n#### 3.5 Funding\n\n  The participating organisations must ensure that sufficient funding is made available to enable complaints to be dealt with under the complaint‑handling procedures in accordance with:\n    (a) the standards set out in this Schedule; and\n    (b) the Privacy Act 1988; and\n    (c) any guidelines made by the Commissioner under paragraph 18BF(1)(b) of that Act.\n\n## Part 4—Fairness\n\n#### 4.1 Overview\n\nPrinciple\n\n  Determinations made under complaint‑handling procedures must be fair, and must be seen to be fair, and therefore:\n     investigations of complaints must be conducted with procedural fairness;\n     determinations must be made on the basis of information before an independent adjudicator;\n     determinations must be made on the basis of specific criteria.\n\nPurpose\n\n  The purpose of this Part is to ensure that determinations made under complaint‑handling procedures are fair and are seen to be fair.\n\n#### 4.2 Complainant to be informed of rights\n\n  The complaint‑handling staff for a privacy code must inform a complainant of his or her rights under the code and the Privacy Act 1988 in relation to:\n    (a) a decision that is made by the complaint‑handling staff in dealing with the complaint; or\n    (b) a determination of an independent adjudicator.\n\n> Note: See section 18BI of the Act, which provides for review by the Commissioner of an independent adjudicator’s determination, and section 55A of the Act, which provides for a proceeding to be commenced in the Federal Court or the Federal Circuit Court for an order to enforce a determination.\n\n#### 4.3 Investigation to be conducted with procedural fairness\n\n  (1) An investigation of a complaint must be conducted with procedural fairness.\n  (2) In particular, each party to the complaint, being the complainant and the respondent organisation, must:\n    (a) be given sufficient information about the case being presented by the other party; and\n    (b) be given a reasonable opportunity to be heard and to respond to anything raised by the other party.\n\n#### 4.4 Power of adjudicator to obtain information or documents\n\n  (1) If an independent adjudicator has reason to believe that a complainant has information or a document relevant to an investigation of a complaint:\n    (a) the adjudicator may give the complainant a written notice requesting the complainant to give the information or document to the adjudicator; and\n    (b) the complainant may, but must not be compelled to, give the information or document to the adjudicator.\n  (2) If an independent adjudicator has reason to believe that a participating organisation has information or a document relevant to an investigation of a complaint:\n    (a) the adjudicator may give the organisation a written notice requesting the organisation to give the information or document to the adjudicator; and\n    (b) subject to subclauses (3) and (4), the organisation must give the information or document to the adjudicator.\n  (3) A participating organisation is not required to give information, or a document, that contains identifying material about a third party to the adjudicator unless the third party has given permission for the information or document to be given to the adjudicator (whether in full or with the identifying material deleted or otherwise removed).\n  (4) A participating organisation is not required to give information or a document to the adjudicator if the organisation is prohibited under a law of the Commonwealth, or of a State or Territory, from disclosing the information or the contents of the document.\n  (5) If a participating organisation gives information, or a document, that contains identifying material about a third party to the adjudicator, the information or document may, at the discretion of the adjudicator, be given to the complainant with the identifying material deleted or otherwise removed.\n  (6) In this clause:\n\n> third party, in relation to a complaint, means a person, other than the complainant or the respondent organisation to the complaint, to whom the respondent organisation owes a duty of confidentiality or privacy.\n\n#### 4.5 Determinations of independent adjudicator\n\n  (1) A determination made by an independent adjudicator in relation to a complaint must be fair and reasonable, having regard to the following:\n    (a) good industry practice;\n    (b) any relevant industry code of practice;\n    (c) the privacy code under which the adjudicator was appointed;\n    (d) any previous determinations made in relation to similar complaints;\n    (e) any relevant law.\n\n> Note: The determinations, findings, declarations, orders and directions that the adjudicator may make under the relevant privacy code after investigating a complaint are the same as those that the Commissioner may make under section 52 of the Act after investigating a complaint under the Act—see paragraph 18BB(3)(d) of the Act.\n\n  (2) As soon as practicable after making a determination in relation to a complaint, an independent adjudicator must inform the complainant and the respondent organisation of the determination and the reasons for the determination.\n\n#### 4.6 Confidentiality\n\n  (1) Any information or document that is provided to an independent adjudicator for the purpose of investigating a complaint must be kept confidential, unless the information or document is required to be disclosed under a law of the Commonwealth, or of a State or Territory, or under any other standard set out in this Schedule.\n  (2) The procedures must ensure that the complainant and the respondent organisation undertake not to disclose any information that is gained in the course of having a complaint dealt with (for example, during any mediation, conciliation or negotiation), unless the information is required to be disclosed under a law of the Commonwealth, or of a State or Territory.\n\n## Part 5—Accountability\n\n#### 5.1 Overview\n\nPrinciple\n\n  The operation of complaint‑handling procedures must be publicly accountable. Reports of determinations and information about complaints must be published and made available.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     the public have confidence in the operation of the complaint‑handling procedures;\n     provision is made for the assessment and improvement of the operation of the procedures and the performance of participating organisations in relation to the collection of personal information.\n\n#### 5.2 Reports of determinations\n\n  (1) Written reports of determinations by an independent adjudicator must:\n    (a) be given, on a regular basis, to each organisation that is bound by the relevant privacy code; and\n    (b) be made available to any other interested person or body.\n  (2) A report must give an account of any determination that the adjudicator considers it appropriate to report on for the purpose of educating participating organisations and individuals, and demonstrating consistency and fairness in determining complaints.\n  (3) A report may include a concise summary of a determination and the reasons for the determination, but need not include all the evidence and arguments presented in relation to the complaint.\n  (4) A report must not:\n    (a) name any complainant or respondent organisation; or\n    (b) include any other personal information about a complainant or any other individual involved in the investigation of a complaint.\n\n## Part 6—Efficiency\n\n#### 6.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must operate efficiently, and therefore:\n     complaints must be dealt with using an appropriate process and forum;\n     complaints must be dealt with in a timely way;\n     the progress of complaints must be tracked.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;\n     the operation of the procedures provides value for its funding.\n\n#### 6.2 Kind of complaints that can be dealt with\n\n  (1) The complaint‑handling procedures must provide that a complaint must not be dealt with under the procedures unless:\n    (a) the complaint is of a kind that can be dealt with under the procedures; and\n    (b) the complaint has not been, or is not being, dealt with by the Commissioner or in another dispute resolution forum; and\n    (c) the complainant has complained to the respondent organisation about the matter to which the complaint relates; and\n    (d) either:\n    (i) the complainant and the respondent organisation have attempted to settle the matter in accordance with the organisation’s internal complaints mechanism; or\n    (ii) the organisation has refused to deal with the matter, or has not dealt with the matter within the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, in accordance with its internal complaints mechanism.\n  (2) The procedures must:\n    (a) provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that it would be more appropriate, having regard to the matter to which the complaint relates, for the complaint to be dealt with by the Commissioner or in another dispute resolution forum; and\n    (b) provide a mechanism or procedure that must be used to refer such a complaint to an appropriate person for it to be dealt with.\n  (3) The procedures must:\n    (a) provide that participating organisations must be informed of any systemic problems in relation to the relevant industry that become apparent from complaints; and\n    (b) provide a mechanism or procedure that must be used to inform organisations of any such systemic problems.\n  (4) The procedures must provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that the complaint is vexatious or frivolous.\n\n#### 6.3 Time in which complaints must be dealt with\n\n  (1) The complaint‑handling procedures must specify reasonable time limits for each process that is required to be carried out in dealing with a complaint, so as to facilitate a resolution of the matter to which the complaint relates as quickly as practicable, but without compromising the quality of any decision or determination made in relation to the complaint.\n  (2) The procedures must provide a mechanism to ensure that, as far as practicable, the time limits are complied with.\n\n#### 6.4 Progress of complaints\n\n  (1) The complaint‑handling procedures must ensure that a system is established and used for the purpose of tracking the progress of complaints.\n  (2) The complaint‑handling staff must inform the complainant and the respondent organisation, in relation to a complaint, about the progress of the complaint.\n\n## Part 7—Effectiveness\n\n#### 7.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must operate effectively, and therefore:\n     the scope of the matters that can be dealt with under the procedures must be appropriate;\n     the operation of the procedures must be regularly reviewed by an independent person.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;\n     the procedures operate as intended.\n\n#### 7.2 Scope of complaint‑handling procedures\n\n  (1) The complaint‑handling procedures must set out clearly:\n    (a) the scope of the matters that can be dealt with under the procedures; and\n    (b) the powers and functions of the independent adjudicator.\n  (2) The scope of the matters that can be dealt with under the procedures must be broad enough to ensure that as many complaints as possible in relation to the relevant industry can be dealt with under the procedures.\n\n#### 7.3 Internal complaints mechanism\n\n  (1) The complaint‑handling procedures must ensure that each organisation that is bound by the relevant privacy code establishes an internal complaints mechanism for the purpose of dealing with complaints.\n\n> Note: Information in relation to the establishment of an internal complaints mechanism is set out in the standard made by Standards Australia entitled Standard on Complaints Handling AS 4269‑1995.\n\n  (2) The procedures must ensure that an independent adjudicator and the complaint‑handling staff for a privacy code have the capacity to give information and advice to a participating organisation about the operation of its internal complaints mechanism.\n\n#### 7.4 Compliance with complaint‑handling procedures\n\n  The complaint‑handling procedures must ensure that appropriate mechanisms are established for the purpose of encouraging participating organisations to comply with the procedures.\n\n> Note: Example: A participating organisation may be encouraged to comply with complaint‑handling procedures if it has undertaken in writing to do so, or if it will be named in an annual report, or other document, for failing to do so.\n\n#### 7.5 Independent review of complaint‑handling procedures\n\n  (1) The complaint‑handling procedures must provide for the operation of the procedures to be reviewed by an independent person within 3 years after the establishment of the procedures and regularly after that time.\n  (2) The person conducting a review must do so in consultation with relevant stakeholders.\n  (3) The person conducting a review must consider the following matters in relation to the procedures:\n    (a) whether the standards set out in this Schedule have been complied with in dealing with complaints;\n    (b) whether the scope of the matters that can be dealt with is appropriate;\n    (c) whether complainants and participating organisations are satisfied with the operation of the procedures;\n    (d) whether the methods and techniques used for dealing with complaints are just and reasonable;\n    (e) whether individuals are able to access the procedures on an equitable basis.\n  (4) The person conducting a review must make the results and findings of the review available to relevant stakeholders.","sortOrder":45},{"sectionNumber":"5.1","sectionType":"section","heading":"Overview","content":"#### 5.1 Overview\n\nPrinciple\n\n  The operation of complaint‑handling procedures must be publicly accountable. Reports of determinations and information about complaints must be published and made available.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     the public have confidence in the operation of the complaint‑handling procedures;\n     provision is made for the assessment and improvement of the operation of the procedures and the performance of participating organisations in relation to the collection of personal information.","sortOrder":46},{"sectionNumber":"5.2","sectionType":"section","heading":"Reports of determinations","content":"#### 5.2 Reports of determinations\n\n  (1) Written reports of determinations by an independent adjudicator must:\n    (a) be given, on a regular basis, to each organisation that is bound by the relevant privacy code; and\n    (b) be made available to any other interested person or body.\n  (2) A report must give an account of any determination that the adjudicator considers it appropriate to report on for the purpose of educating participating organisations and individuals, and demonstrating consistency and fairness in determining complaints.\n  (3) A report may include a concise summary of a determination and the reasons for the determination, but need not include all the evidence and arguments presented in relation to the complaint.\n  (4) A report must not:\n    (a) name any complainant or respondent organisation; or\n    (b) include any other personal information about a complainant or any other individual involved in the investigation of a complaint.","sortOrder":47},{"sectionNumber":"Part 6","sectionType":"part","heading":"Efficiency","content":"Schedule 1—Privacy codes—prescribed standards for procedures relating to complaints\n\n(regulation 5)\n\n## Part 1—General\n\n#### 1.1 Object\n\n  (1) This Schedule sets out the standards that must be met by complaint‑handling procedures that are set out in a privacy code.\n  (2) The standards apply to complaints that are made to an independent adjudicator who is appointed under the code.\n\n#### 1.2 Definitions\n\n  In this Schedule, unless the contrary intention appears:\n\n> complaint means a complaint that is made by an individual about an act or practice of an organisation that may be an interference with the privacy of the individual.\n\n> independent adjudicator means the person who is appointed under a privacy code as an independent person to whom a complaint may be made.\n\n> Note: The Australian Information Commissioner may be appointed as an independent adjudicator under a privacy code.\n\n> participating organisation, in relation to a privacy code, means an organisation that is bound by the code.\n\n> respondent organisation, in relation to a complaint, means the participating organisation against whom the complaint is made.\n\n## Part 2—Accessibility\n\n#### 2.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must:\n     be readily available to any individual about whom a participating organisation holds personal information;\n     be promoted widely;\n     be easy to use;\n     be able to be used by complainants without any charge or fee.\n\nPurpose\n\n  The purpose of this Part is to ensure that complaint‑handling procedures are accessible, on an equitable basis, to any individual about whom a participating organisation holds personal information.\n\n#### 2.2 Procedures to be in writing\n\n  (1) The complaint‑handling procedures must be in writing.\n  (2) The procedures must be clearly expressed and must deal with the following matters:\n    (a) how to make a complaint;\n    (b) how a complaint will be dealt with;\n    (c) the kind of complaints that can be dealt with under the procedures;\n    (d) any restrictions on the kind of complaints that can be dealt with under the procedures.\n\n#### 2.3 Awareness and promotion\n\n  (1) The existence of the complaint‑handling procedures must be promoted as widely as possible to the class or classes of individuals to whom it is relevant, using news media or any other appropriate means.\n  (2) The methods used for promoting the existence of the procedures must be appropriate for all individuals, and, in particular, must be sensitive to the needs of individuals with disabilities and disadvantaged individuals (for example, those who cannot read or write).\n\n#### 2.4 Copies of procedures to be made available\n\n  (1) A copy of the complaint‑handling procedures must be readily available:\n    (a) to a complainant, as soon as practicable after the complaint is made; and\n    (b) to anyone else who asks for it.\n  (2) The procedures must ensure that a participating organisation is compelled to give a copy of the complaint‑handling procedures to an individual if:\n    (a) the individual has complained to the organisation about an act or practice of the organisation that may be an interference with the privacy of the individual; and\n    (b) any of the following occurs:\n    (i) the complaint is dealt with in accordance with the organisation’s internal complaints mechanism (whether or not the individual is satisfied with the outcome);\n    (ii) the organisation refuses to deal with the complaint;\n    (iii) the organisation does not deal with the complaint in the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, or in accordance with the organisation’s internal complaints mechanism.\n  (3) If an organisation is required to give a copy of the complaint‑handling procedures to an individual under subclause (2), the organisation must give the copy to the individual, as the case requires:\n    (a) when the individual’s complaint has been dealt with; or\n    (b) when the decision to refuse to deal with the individual’s complaint is made; or\n    (c) at the end of the time when the individual’s complaint should have been dealt with.\n\n#### 2.5 Access to procedures\n\n  (1) The complaint‑handling procedures must be accessible to any individual about whom a participating organisation holds personal information, regardless of where the individual is located.\n\n> Note: Example: Access to the complaint‑handling procedures may be provided by a toll‑free telephone service or by sending a copy of the procedures to an individual.\n\n  (2) The procedures must ensure that appropriate facilities and assistance are provided for individuals with disabilities and disadvantaged individuals.\n  (3) The procedures must ensure that an individual may contact a participating organisation in relation to a possible complaint orally or in writing.\n  (4) The procedures must require a complaint to be made in writing.\n\n> Note: Appropriately trained staff must, if necessary, assist a complainant to prepare a complaint in writing—see subclause 2.7(3) of this Schedule.\n\n#### 2.6 Cost\n\n  A complainant must not be charged a fee for making a complaint or having a complaint dealt with.\n\n#### 2.7 Complaint‑handling staff\n\n  (1) A complaint must be handled by staff with the appropriate ability and training.\n  (2) The complaint‑handling staff must explain the following matters to a complainant as simply as possible:\n    (a) how a complaint will be dealt with;\n    (b) the matters that will be dealt with in relation to a complaint;\n    (c) any restrictions on the matters that will be dealt with in relation to a complaint;\n    (d) the expected time needed for each process to be carried out in dealing with the complaint.\n  (3) The complaint‑handling staff must assist a complainant to prepare a written complaint if the complainant needs such assistance.\n\n#### 2.8 Methods for dealing with complaints\n\n  (1) The complaint‑handling procedures must be as simple as possible for complainants to understand and use.\n  (2) In particular, a complaint must be dealt with:\n    (a) using appropriate methods and techniques (including conciliation, mediation and negotiation); and\n    (b) with as little formality and technicality, and with as much expedition, as a proper consideration of the complaint permits.\n\n#### 2.9 Presentation of complainant’s case\n\n  (1) The independent adjudicator must decide whether the complainant’s case in relation to the complaint is to be presented orally or in writing.\n  (2) The adjudicator must permit another person to support the complainant at any time while the complaint is being dealt with.\n\n#### 2.10 Representation of complainant by legal practitioner\n\n  (1) The complainant, or the respondent organisation, may be represented by a legal practitioner only if:\n    (a) the complainant or respondent organisation makes a request to the adjudicator to be legally represented; and\n    (b) the adjudicator considers that special circumstances exist in relation to the complaint.\n  (2) If either party, being the complainant or the respondent organisation, is represented by a legal practitioner, the other party may also be represented by a legal practitioner.\n  (3) If:\n    (a) the respondent organisation requests that it be represented by a legal practitioner; and\n    (b) after that request, the complainant requests that he or she be represented by a legal practitioner; and\n    (c) the adjudicator grants both requests;\n  the respondent organisation must pay the complainant’s legal costs.\n\n## Part 3—Independence\n\n#### 3.1 Overview\n\nPrinciple\n\n  The administration of, and process of making determinations under, the complaint‑handling procedures must be independent from all participating organisations.\n\nPurpose\n\n  The purpose of this Part is to ensure that all processes carried out under the complaint‑handling procedures, and all determinations made under the procedures, are carried out or made in an objective and unbiased way and are seen to be carried out, or made, in an objective and unbiased way.\n\n#### 3.2 Independent adjudicator\n\n  (1) A person who is appointed as an independent adjudicator under a privacy code must be appointed for a fixed term.\n  (2) An adjudicator for a privacy code must not be selected directly by any organisation that is bound by that code.\n  (3) An adjudicator must not be answerable to any participating organisation in relation to his or her determinations, except as otherwise provided by the standards set out in this Schedule.\n  (4) An adjudicator must not have any relationship with any participating organisation that could give rise to a perceived or actual conflict of interest in relation to the performance of the adjudicator’s functions.\n\n#### 3.3 Complaint‑handling staff\n\n  (1) The complaint‑handling staff for a privacy code must not be selected directly by any organisation that is bound by that code.\n  (2) The complaint‑handling staff must not be answerable to any participating organisation in relation to the operation of the complaint‑handling procedures, except as otherwise provided by the standards set out in this Schedule.\n\n#### 3.4 Overseeing entity\n\n  (1) The complaint‑handling procedures must ensure that the operation of the procedures is formally overseen by an overseeing entity consisting of as many members as are appropriate to provide a balance of representation of the interests of the following groups:\n    (a) the class or classes of individuals to whom the procedures are relevant (the relevant individuals);\n    (b) the relevant industry;\n    (c) if appropriate, other relevant stakeholders.\n  (2) A person who is appointed as a member of the overseeing entity to represent the interests of the relevant individuals must be a person:\n    (a) who is capable of reflecting the views and concerns of the relevant individuals; and\n    (b) in whom the relevant individuals and any relevant organisations have confidence.\n  (3) The procedures must ensure that the overseeing entity has the following functions:\n    (a) to appoint or dismiss an independent adjudicator under the relevant privacy code;\n    (b) to make recommendations in relation to, and approve, the budget for the operation of the procedures.\n\n#### 3.5 Funding\n\n  The participating organisations must ensure that sufficient funding is made available to enable complaints to be dealt with under the complaint‑handling procedures in accordance with:\n    (a) the standards set out in this Schedule; and\n    (b) the Privacy Act 1988; and\n    (c) any guidelines made by the Commissioner under paragraph 18BF(1)(b) of that Act.\n\n## Part 4—Fairness\n\n#### 4.1 Overview\n\nPrinciple\n\n  Determinations made under complaint‑handling procedures must be fair, and must be seen to be fair, and therefore:\n     investigations of complaints must be conducted with procedural fairness;\n     determinations must be made on the basis of information before an independent adjudicator;\n     determinations must be made on the basis of specific criteria.\n\nPurpose\n\n  The purpose of this Part is to ensure that determinations made under complaint‑handling procedures are fair and are seen to be fair.\n\n#### 4.2 Complainant to be informed of rights\n\n  The complaint‑handling staff for a privacy code must inform a complainant of his or her rights under the code and the Privacy Act 1988 in relation to:\n    (a) a decision that is made by the complaint‑handling staff in dealing with the complaint; or\n    (b) a determination of an independent adjudicator.\n\n> Note: See section 18BI of the Act, which provides for review by the Commissioner of an independent adjudicator’s determination, and section 55A of the Act, which provides for a proceeding to be commenced in the Federal Court or the Federal Circuit Court for an order to enforce a determination.\n\n#### 4.3 Investigation to be conducted with procedural fairness\n\n  (1) An investigation of a complaint must be conducted with procedural fairness.\n  (2) In particular, each party to the complaint, being the complainant and the respondent organisation, must:\n    (a) be given sufficient information about the case being presented by the other party; and\n    (b) be given a reasonable opportunity to be heard and to respond to anything raised by the other party.\n\n#### 4.4 Power of adjudicator to obtain information or documents\n\n  (1) If an independent adjudicator has reason to believe that a complainant has information or a document relevant to an investigation of a complaint:\n    (a) the adjudicator may give the complainant a written notice requesting the complainant to give the information or document to the adjudicator; and\n    (b) the complainant may, but must not be compelled to, give the information or document to the adjudicator.\n  (2) If an independent adjudicator has reason to believe that a participating organisation has information or a document relevant to an investigation of a complaint:\n    (a) the adjudicator may give the organisation a written notice requesting the organisation to give the information or document to the adjudicator; and\n    (b) subject to subclauses (3) and (4), the organisation must give the information or document to the adjudicator.\n  (3) A participating organisation is not required to give information, or a document, that contains identifying material about a third party to the adjudicator unless the third party has given permission for the information or document to be given to the adjudicator (whether in full or with the identifying material deleted or otherwise removed).\n  (4) A participating organisation is not required to give information or a document to the adjudicator if the organisation is prohibited under a law of the Commonwealth, or of a State or Territory, from disclosing the information or the contents of the document.\n  (5) If a participating organisation gives information, or a document, that contains identifying material about a third party to the adjudicator, the information or document may, at the discretion of the adjudicator, be given to the complainant with the identifying material deleted or otherwise removed.\n  (6) In this clause:\n\n> third party, in relation to a complaint, means a person, other than the complainant or the respondent organisation to the complaint, to whom the respondent organisation owes a duty of confidentiality or privacy.\n\n#### 4.5 Determinations of independent adjudicator\n\n  (1) A determination made by an independent adjudicator in relation to a complaint must be fair and reasonable, having regard to the following:\n    (a) good industry practice;\n    (b) any relevant industry code of practice;\n    (c) the privacy code under which the adjudicator was appointed;\n    (d) any previous determinations made in relation to similar complaints;\n    (e) any relevant law.\n\n> Note: The determinations, findings, declarations, orders and directions that the adjudicator may make under the relevant privacy code after investigating a complaint are the same as those that the Commissioner may make under section 52 of the Act after investigating a complaint under the Act—see paragraph 18BB(3)(d) of the Act.\n\n  (2) As soon as practicable after making a determination in relation to a complaint, an independent adjudicator must inform the complainant and the respondent organisation of the determination and the reasons for the determination.\n\n#### 4.6 Confidentiality\n\n  (1) Any information or document that is provided to an independent adjudicator for the purpose of investigating a complaint must be kept confidential, unless the information or document is required to be disclosed under a law of the Commonwealth, or of a State or Territory, or under any other standard set out in this Schedule.\n  (2) The procedures must ensure that the complainant and the respondent organisation undertake not to disclose any information that is gained in the course of having a complaint dealt with (for example, during any mediation, conciliation or negotiation), unless the information is required to be disclosed under a law of the Commonwealth, or of a State or Territory.\n\n## Part 5—Accountability\n\n#### 5.1 Overview\n\nPrinciple\n\n  The operation of complaint‑handling procedures must be publicly accountable. Reports of determinations and information about complaints must be published and made available.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     the public have confidence in the operation of the complaint‑handling procedures;\n     provision is made for the assessment and improvement of the operation of the procedures and the performance of participating organisations in relation to the collection of personal information.\n\n#### 5.2 Reports of determinations\n\n  (1) Written reports of determinations by an independent adjudicator must:\n    (a) be given, on a regular basis, to each organisation that is bound by the relevant privacy code; and\n    (b) be made available to any other interested person or body.\n  (2) A report must give an account of any determination that the adjudicator considers it appropriate to report on for the purpose of educating participating organisations and individuals, and demonstrating consistency and fairness in determining complaints.\n  (3) A report may include a concise summary of a determination and the reasons for the determination, but need not include all the evidence and arguments presented in relation to the complaint.\n  (4) A report must not:\n    (a) name any complainant or respondent organisation; or\n    (b) include any other personal information about a complainant or any other individual involved in the investigation of a complaint.\n\n## Part 6—Efficiency\n\n#### 6.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must operate efficiently, and therefore:\n     complaints must be dealt with using an appropriate process and forum;\n     complaints must be dealt with in a timely way;\n     the progress of complaints must be tracked.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;\n     the operation of the procedures provides value for its funding.\n\n#### 6.2 Kind of complaints that can be dealt with\n\n  (1) The complaint‑handling procedures must provide that a complaint must not be dealt with under the procedures unless:\n    (a) the complaint is of a kind that can be dealt with under the procedures; and\n    (b) the complaint has not been, or is not being, dealt with by the Commissioner or in another dispute resolution forum; and\n    (c) the complainant has complained to the respondent organisation about the matter to which the complaint relates; and\n    (d) either:\n    (i) the complainant and the respondent organisation have attempted to settle the matter in accordance with the organisation’s internal complaints mechanism; or\n    (ii) the organisation has refused to deal with the matter, or has not dealt with the matter within the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, in accordance with its internal complaints mechanism.\n  (2) The procedures must:\n    (a) provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that it would be more appropriate, having regard to the matter to which the complaint relates, for the complaint to be dealt with by the Commissioner or in another dispute resolution forum; and\n    (b) provide a mechanism or procedure that must be used to refer such a complaint to an appropriate person for it to be dealt with.\n  (3) The procedures must:\n    (a) provide that participating organisations must be informed of any systemic problems in relation to the relevant industry that become apparent from complaints; and\n    (b) provide a mechanism or procedure that must be used to inform organisations of any such systemic problems.\n  (4) The procedures must provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that the complaint is vexatious or frivolous.\n\n#### 6.3 Time in which complaints must be dealt with\n\n  (1) The complaint‑handling procedures must specify reasonable time limits for each process that is required to be carried out in dealing with a complaint, so as to facilitate a resolution of the matter to which the complaint relates as quickly as practicable, but without compromising the quality of any decision or determination made in relation to the complaint.\n  (2) The procedures must provide a mechanism to ensure that, as far as practicable, the time limits are complied with.\n\n#### 6.4 Progress of complaints\n\n  (1) The complaint‑handling procedures must ensure that a system is established and used for the purpose of tracking the progress of complaints.\n  (2) The complaint‑handling staff must inform the complainant and the respondent organisation, in relation to a complaint, about the progress of the complaint.\n\n## Part 7—Effectiveness\n\n#### 7.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must operate effectively, and therefore:\n     the scope of the matters that can be dealt with under the procedures must be appropriate;\n     the operation of the procedures must be regularly reviewed by an independent person.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;\n     the procedures operate as intended.\n\n#### 7.2 Scope of complaint‑handling procedures\n\n  (1) The complaint‑handling procedures must set out clearly:\n    (a) the scope of the matters that can be dealt with under the procedures; and\n    (b) the powers and functions of the independent adjudicator.\n  (2) The scope of the matters that can be dealt with under the procedures must be broad enough to ensure that as many complaints as possible in relation to the relevant industry can be dealt with under the procedures.\n\n#### 7.3 Internal complaints mechanism\n\n  (1) The complaint‑handling procedures must ensure that each organisation that is bound by the relevant privacy code establishes an internal complaints mechanism for the purpose of dealing with complaints.\n\n> Note: Information in relation to the establishment of an internal complaints mechanism is set out in the standard made by Standards Australia entitled Standard on Complaints Handling AS 4269‑1995.\n\n  (2) The procedures must ensure that an independent adjudicator and the complaint‑handling staff for a privacy code have the capacity to give information and advice to a participating organisation about the operation of its internal complaints mechanism.\n\n#### 7.4 Compliance with complaint‑handling procedures\n\n  The complaint‑handling procedures must ensure that appropriate mechanisms are established for the purpose of encouraging participating organisations to comply with the procedures.\n\n> Note: Example: A participating organisation may be encouraged to comply with complaint‑handling procedures if it has undertaken in writing to do so, or if it will be named in an annual report, or other document, for failing to do so.\n\n#### 7.5 Independent review of complaint‑handling procedures\n\n  (1) The complaint‑handling procedures must provide for the operation of the procedures to be reviewed by an independent person within 3 years after the establishment of the procedures and regularly after that time.\n  (2) The person conducting a review must do so in consultation with relevant stakeholders.\n  (3) The person conducting a review must consider the following matters in relation to the procedures:\n    (a) whether the standards set out in this Schedule have been complied with in dealing with complaints;\n    (b) whether the scope of the matters that can be dealt with is appropriate;\n    (c) whether complainants and participating organisations are satisfied with the operation of the procedures;\n    (d) whether the methods and techniques used for dealing with complaints are just and reasonable;\n    (e) whether individuals are able to access the procedures on an equitable basis.\n  (4) The person conducting a review must make the results and findings of the review available to relevant stakeholders.","sortOrder":48},{"sectionNumber":"6.1","sectionType":"section","heading":"Overview","content":"#### 6.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must operate efficiently, and therefore:\n     complaints must be dealt with using an appropriate process and forum;\n     complaints must be dealt with in a timely way;\n     the progress of complaints must be tracked.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;\n     the operation of the procedures provides value for its funding.","sortOrder":49},{"sectionNumber":"6.2","sectionType":"section","heading":"Kind of complaints that can be dealt with","content":"#### 6.2 Kind of complaints that can be dealt with\n\n  (1) The complaint‑handling procedures must provide that a complaint must not be dealt with under the procedures unless:\n    (a) the complaint is of a kind that can be dealt with under the procedures; and\n    (b) the complaint has not been, or is not being, dealt with by the Commissioner or in another dispute resolution forum; and\n    (c) the complainant has complained to the respondent organisation about the matter to which the complaint relates; and\n    (d) either:\n    (i) the complainant and the respondent organisation have attempted to settle the matter in accordance with the organisation’s internal complaints mechanism; or\n    (ii) the organisation has refused to deal with the matter, or has not dealt with the matter within the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, in accordance with its internal complaints mechanism.\n  (2) The procedures must:\n    (a) provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that it would be more appropriate, having regard to the matter to which the complaint relates, for the complaint to be dealt with by the Commissioner or in another dispute resolution forum; and\n    (b) provide a mechanism or procedure that must be used to refer such a complaint to an appropriate person for it to be dealt with.\n  (3) The procedures must:\n    (a) provide that participating organisations must be informed of any systemic problems in relation to the relevant industry that become apparent from complaints; and\n    (b) provide a mechanism or procedure that must be used to inform organisations of any such systemic problems.\n  (4) The procedures must provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that the complaint is vexatious or frivolous.","sortOrder":50},{"sectionNumber":"6.3","sectionType":"section","heading":"Time in which complaints must be dealt with","content":"#### 6.3 Time in which complaints must be dealt with\n\n  (1) The complaint‑handling procedures must specify reasonable time limits for each process that is required to be carried out in dealing with a complaint, so as to facilitate a resolution of the matter to which the complaint relates as quickly as practicable, but without compromising the quality of any decision or determination made in relation to the complaint.\n  (2) The procedures must provide a mechanism to ensure that, as far as practicable, the time limits are complied with.","sortOrder":51},{"sectionNumber":"6.4","sectionType":"section","heading":"Progress of complaints","content":"#### 6.4 Progress of complaints\n\n  (1) The complaint‑handling procedures must ensure that a system is established and used for the purpose of tracking the progress of complaints.\n  (2) The complaint‑handling staff must inform the complainant and the respondent organisation, in relation to a complaint, about the progress of the complaint.","sortOrder":52},{"sectionNumber":"Part 7","sectionType":"part","heading":"Effectiveness","content":"Schedule 1—Privacy codes—prescribed standards for procedures relating to complaints\n\n(regulation 5)\n\n## Part 1—General\n\n#### 1.1 Object\n\n  (1) This Schedule sets out the standards that must be met by complaint‑handling procedures that are set out in a privacy code.\n  (2) The standards apply to complaints that are made to an independent adjudicator who is appointed under the code.\n\n#### 1.2 Definitions\n\n  In this Schedule, unless the contrary intention appears:\n\n> complaint means a complaint that is made by an individual about an act or practice of an organisation that may be an interference with the privacy of the individual.\n\n> independent adjudicator means the person who is appointed under a privacy code as an independent person to whom a complaint may be made.\n\n> Note: The Australian Information Commissioner may be appointed as an independent adjudicator under a privacy code.\n\n> participating organisation, in relation to a privacy code, means an organisation that is bound by the code.\n\n> respondent organisation, in relation to a complaint, means the participating organisation against whom the complaint is made.\n\n## Part 2—Accessibility\n\n#### 2.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must:\n     be readily available to any individual about whom a participating organisation holds personal information;\n     be promoted widely;\n     be easy to use;\n     be able to be used by complainants without any charge or fee.\n\nPurpose\n\n  The purpose of this Part is to ensure that complaint‑handling procedures are accessible, on an equitable basis, to any individual about whom a participating organisation holds personal information.\n\n#### 2.2 Procedures to be in writing\n\n  (1) The complaint‑handling procedures must be in writing.\n  (2) The procedures must be clearly expressed and must deal with the following matters:\n    (a) how to make a complaint;\n    (b) how a complaint will be dealt with;\n    (c) the kind of complaints that can be dealt with under the procedures;\n    (d) any restrictions on the kind of complaints that can be dealt with under the procedures.\n\n#### 2.3 Awareness and promotion\n\n  (1) The existence of the complaint‑handling procedures must be promoted as widely as possible to the class or classes of individuals to whom it is relevant, using news media or any other appropriate means.\n  (2) The methods used for promoting the existence of the procedures must be appropriate for all individuals, and, in particular, must be sensitive to the needs of individuals with disabilities and disadvantaged individuals (for example, those who cannot read or write).\n\n#### 2.4 Copies of procedures to be made available\n\n  (1) A copy of the complaint‑handling procedures must be readily available:\n    (a) to a complainant, as soon as practicable after the complaint is made; and\n    (b) to anyone else who asks for it.\n  (2) The procedures must ensure that a participating organisation is compelled to give a copy of the complaint‑handling procedures to an individual if:\n    (a) the individual has complained to the organisation about an act or practice of the organisation that may be an interference with the privacy of the individual; and\n    (b) any of the following occurs:\n    (i) the complaint is dealt with in accordance with the organisation’s internal complaints mechanism (whether or not the individual is satisfied with the outcome);\n    (ii) the organisation refuses to deal with the complaint;\n    (iii) the organisation does not deal with the complaint in the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, or in accordance with the organisation’s internal complaints mechanism.\n  (3) If an organisation is required to give a copy of the complaint‑handling procedures to an individual under subclause (2), the organisation must give the copy to the individual, as the case requires:\n    (a) when the individual’s complaint has been dealt with; or\n    (b) when the decision to refuse to deal with the individual’s complaint is made; or\n    (c) at the end of the time when the individual’s complaint should have been dealt with.\n\n#### 2.5 Access to procedures\n\n  (1) The complaint‑handling procedures must be accessible to any individual about whom a participating organisation holds personal information, regardless of where the individual is located.\n\n> Note: Example: Access to the complaint‑handling procedures may be provided by a toll‑free telephone service or by sending a copy of the procedures to an individual.\n\n  (2) The procedures must ensure that appropriate facilities and assistance are provided for individuals with disabilities and disadvantaged individuals.\n  (3) The procedures must ensure that an individual may contact a participating organisation in relation to a possible complaint orally or in writing.\n  (4) The procedures must require a complaint to be made in writing.\n\n> Note: Appropriately trained staff must, if necessary, assist a complainant to prepare a complaint in writing—see subclause 2.7(3) of this Schedule.\n\n#### 2.6 Cost\n\n  A complainant must not be charged a fee for making a complaint or having a complaint dealt with.\n\n#### 2.7 Complaint‑handling staff\n\n  (1) A complaint must be handled by staff with the appropriate ability and training.\n  (2) The complaint‑handling staff must explain the following matters to a complainant as simply as possible:\n    (a) how a complaint will be dealt with;\n    (b) the matters that will be dealt with in relation to a complaint;\n    (c) any restrictions on the matters that will be dealt with in relation to a complaint;\n    (d) the expected time needed for each process to be carried out in dealing with the complaint.\n  (3) The complaint‑handling staff must assist a complainant to prepare a written complaint if the complainant needs such assistance.\n\n#### 2.8 Methods for dealing with complaints\n\n  (1) The complaint‑handling procedures must be as simple as possible for complainants to understand and use.\n  (2) In particular, a complaint must be dealt with:\n    (a) using appropriate methods and techniques (including conciliation, mediation and negotiation); and\n    (b) with as little formality and technicality, and with as much expedition, as a proper consideration of the complaint permits.\n\n#### 2.9 Presentation of complainant’s case\n\n  (1) The independent adjudicator must decide whether the complainant’s case in relation to the complaint is to be presented orally or in writing.\n  (2) The adjudicator must permit another person to support the complainant at any time while the complaint is being dealt with.\n\n#### 2.10 Representation of complainant by legal practitioner\n\n  (1) The complainant, or the respondent organisation, may be represented by a legal practitioner only if:\n    (a) the complainant or respondent organisation makes a request to the adjudicator to be legally represented; and\n    (b) the adjudicator considers that special circumstances exist in relation to the complaint.\n  (2) If either party, being the complainant or the respondent organisation, is represented by a legal practitioner, the other party may also be represented by a legal practitioner.\n  (3) If:\n    (a) the respondent organisation requests that it be represented by a legal practitioner; and\n    (b) after that request, the complainant requests that he or she be represented by a legal practitioner; and\n    (c) the adjudicator grants both requests;\n  the respondent organisation must pay the complainant’s legal costs.\n\n## Part 3—Independence\n\n#### 3.1 Overview\n\nPrinciple\n\n  The administration of, and process of making determinations under, the complaint‑handling procedures must be independent from all participating organisations.\n\nPurpose\n\n  The purpose of this Part is to ensure that all processes carried out under the complaint‑handling procedures, and all determinations made under the procedures, are carried out or made in an objective and unbiased way and are seen to be carried out, or made, in an objective and unbiased way.\n\n#### 3.2 Independent adjudicator\n\n  (1) A person who is appointed as an independent adjudicator under a privacy code must be appointed for a fixed term.\n  (2) An adjudicator for a privacy code must not be selected directly by any organisation that is bound by that code.\n  (3) An adjudicator must not be answerable to any participating organisation in relation to his or her determinations, except as otherwise provided by the standards set out in this Schedule.\n  (4) An adjudicator must not have any relationship with any participating organisation that could give rise to a perceived or actual conflict of interest in relation to the performance of the adjudicator’s functions.\n\n#### 3.3 Complaint‑handling staff\n\n  (1) The complaint‑handling staff for a privacy code must not be selected directly by any organisation that is bound by that code.\n  (2) The complaint‑handling staff must not be answerable to any participating organisation in relation to the operation of the complaint‑handling procedures, except as otherwise provided by the standards set out in this Schedule.\n\n#### 3.4 Overseeing entity\n\n  (1) The complaint‑handling procedures must ensure that the operation of the procedures is formally overseen by an overseeing entity consisting of as many members as are appropriate to provide a balance of representation of the interests of the following groups:\n    (a) the class or classes of individuals to whom the procedures are relevant (the relevant individuals);\n    (b) the relevant industry;\n    (c) if appropriate, other relevant stakeholders.\n  (2) A person who is appointed as a member of the overseeing entity to represent the interests of the relevant individuals must be a person:\n    (a) who is capable of reflecting the views and concerns of the relevant individuals; and\n    (b) in whom the relevant individuals and any relevant organisations have confidence.\n  (3) The procedures must ensure that the overseeing entity has the following functions:\n    (a) to appoint or dismiss an independent adjudicator under the relevant privacy code;\n    (b) to make recommendations in relation to, and approve, the budget for the operation of the procedures.\n\n#### 3.5 Funding\n\n  The participating organisations must ensure that sufficient funding is made available to enable complaints to be dealt with under the complaint‑handling procedures in accordance with:\n    (a) the standards set out in this Schedule; and\n    (b) the Privacy Act 1988; and\n    (c) any guidelines made by the Commissioner under paragraph 18BF(1)(b) of that Act.\n\n## Part 4—Fairness\n\n#### 4.1 Overview\n\nPrinciple\n\n  Determinations made under complaint‑handling procedures must be fair, and must be seen to be fair, and therefore:\n     investigations of complaints must be conducted with procedural fairness;\n     determinations must be made on the basis of information before an independent adjudicator;\n     determinations must be made on the basis of specific criteria.\n\nPurpose\n\n  The purpose of this Part is to ensure that determinations made under complaint‑handling procedures are fair and are seen to be fair.\n\n#### 4.2 Complainant to be informed of rights\n\n  The complaint‑handling staff for a privacy code must inform a complainant of his or her rights under the code and the Privacy Act 1988 in relation to:\n    (a) a decision that is made by the complaint‑handling staff in dealing with the complaint; or\n    (b) a determination of an independent adjudicator.\n\n> Note: See section 18BI of the Act, which provides for review by the Commissioner of an independent adjudicator’s determination, and section 55A of the Act, which provides for a proceeding to be commenced in the Federal Court or the Federal Circuit Court for an order to enforce a determination.\n\n#### 4.3 Investigation to be conducted with procedural fairness\n\n  (1) An investigation of a complaint must be conducted with procedural fairness.\n  (2) In particular, each party to the complaint, being the complainant and the respondent organisation, must:\n    (a) be given sufficient information about the case being presented by the other party; and\n    (b) be given a reasonable opportunity to be heard and to respond to anything raised by the other party.\n\n#### 4.4 Power of adjudicator to obtain information or documents\n\n  (1) If an independent adjudicator has reason to believe that a complainant has information or a document relevant to an investigation of a complaint:\n    (a) the adjudicator may give the complainant a written notice requesting the complainant to give the information or document to the adjudicator; and\n    (b) the complainant may, but must not be compelled to, give the information or document to the adjudicator.\n  (2) If an independent adjudicator has reason to believe that a participating organisation has information or a document relevant to an investigation of a complaint:\n    (a) the adjudicator may give the organisation a written notice requesting the organisation to give the information or document to the adjudicator; and\n    (b) subject to subclauses (3) and (4), the organisation must give the information or document to the adjudicator.\n  (3) A participating organisation is not required to give information, or a document, that contains identifying material about a third party to the adjudicator unless the third party has given permission for the information or document to be given to the adjudicator (whether in full or with the identifying material deleted or otherwise removed).\n  (4) A participating organisation is not required to give information or a document to the adjudicator if the organisation is prohibited under a law of the Commonwealth, or of a State or Territory, from disclosing the information or the contents of the document.\n  (5) If a participating organisation gives information, or a document, that contains identifying material about a third party to the adjudicator, the information or document may, at the discretion of the adjudicator, be given to the complainant with the identifying material deleted or otherwise removed.\n  (6) In this clause:\n\n> third party, in relation to a complaint, means a person, other than the complainant or the respondent organisation to the complaint, to whom the respondent organisation owes a duty of confidentiality or privacy.\n\n#### 4.5 Determinations of independent adjudicator\n\n  (1) A determination made by an independent adjudicator in relation to a complaint must be fair and reasonable, having regard to the following:\n    (a) good industry practice;\n    (b) any relevant industry code of practice;\n    (c) the privacy code under which the adjudicator was appointed;\n    (d) any previous determinations made in relation to similar complaints;\n    (e) any relevant law.\n\n> Note: The determinations, findings, declarations, orders and directions that the adjudicator may make under the relevant privacy code after investigating a complaint are the same as those that the Commissioner may make under section 52 of the Act after investigating a complaint under the Act—see paragraph 18BB(3)(d) of the Act.\n\n  (2) As soon as practicable after making a determination in relation to a complaint, an independent adjudicator must inform the complainant and the respondent organisation of the determination and the reasons for the determination.\n\n#### 4.6 Confidentiality\n\n  (1) Any information or document that is provided to an independent adjudicator for the purpose of investigating a complaint must be kept confidential, unless the information or document is required to be disclosed under a law of the Commonwealth, or of a State or Territory, or under any other standard set out in this Schedule.\n  (2) The procedures must ensure that the complainant and the respondent organisation undertake not to disclose any information that is gained in the course of having a complaint dealt with (for example, during any mediation, conciliation or negotiation), unless the information is required to be disclosed under a law of the Commonwealth, or of a State or Territory.\n\n## Part 5—Accountability\n\n#### 5.1 Overview\n\nPrinciple\n\n  The operation of complaint‑handling procedures must be publicly accountable. Reports of determinations and information about complaints must be published and made available.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     the public have confidence in the operation of the complaint‑handling procedures;\n     provision is made for the assessment and improvement of the operation of the procedures and the performance of participating organisations in relation to the collection of personal information.\n\n#### 5.2 Reports of determinations\n\n  (1) Written reports of determinations by an independent adjudicator must:\n    (a) be given, on a regular basis, to each organisation that is bound by the relevant privacy code; and\n    (b) be made available to any other interested person or body.\n  (2) A report must give an account of any determination that the adjudicator considers it appropriate to report on for the purpose of educating participating organisations and individuals, and demonstrating consistency and fairness in determining complaints.\n  (3) A report may include a concise summary of a determination and the reasons for the determination, but need not include all the evidence and arguments presented in relation to the complaint.\n  (4) A report must not:\n    (a) name any complainant or respondent organisation; or\n    (b) include any other personal information about a complainant or any other individual involved in the investigation of a complaint.\n\n## Part 6—Efficiency\n\n#### 6.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must operate efficiently, and therefore:\n     complaints must be dealt with using an appropriate process and forum;\n     complaints must be dealt with in a timely way;\n     the progress of complaints must be tracked.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;\n     the operation of the procedures provides value for its funding.\n\n#### 6.2 Kind of complaints that can be dealt with\n\n  (1) The complaint‑handling procedures must provide that a complaint must not be dealt with under the procedures unless:\n    (a) the complaint is of a kind that can be dealt with under the procedures; and\n    (b) the complaint has not been, or is not being, dealt with by the Commissioner or in another dispute resolution forum; and\n    (c) the complainant has complained to the respondent organisation about the matter to which the complaint relates; and\n    (d) either:\n    (i) the complainant and the respondent organisation have attempted to settle the matter in accordance with the organisation’s internal complaints mechanism; or\n    (ii) the organisation has refused to deal with the matter, or has not dealt with the matter within the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, in accordance with its internal complaints mechanism.\n  (2) The procedures must:\n    (a) provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that it would be more appropriate, having regard to the matter to which the complaint relates, for the complaint to be dealt with by the Commissioner or in another dispute resolution forum; and\n    (b) provide a mechanism or procedure that must be used to refer such a complaint to an appropriate person for it to be dealt with.\n  (3) The procedures must:\n    (a) provide that participating organisations must be informed of any systemic problems in relation to the relevant industry that become apparent from complaints; and\n    (b) provide a mechanism or procedure that must be used to inform organisations of any such systemic problems.\n  (4) The procedures must provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that the complaint is vexatious or frivolous.\n\n#### 6.3 Time in which complaints must be dealt with\n\n  (1) The complaint‑handling procedures must specify reasonable time limits for each process that is required to be carried out in dealing with a complaint, so as to facilitate a resolution of the matter to which the complaint relates as quickly as practicable, but without compromising the quality of any decision or determination made in relation to the complaint.\n  (2) The procedures must provide a mechanism to ensure that, as far as practicable, the time limits are complied with.\n\n#### 6.4 Progress of complaints\n\n  (1) The complaint‑handling procedures must ensure that a system is established and used for the purpose of tracking the progress of complaints.\n  (2) The complaint‑handling staff must inform the complainant and the respondent organisation, in relation to a complaint, about the progress of the complaint.\n\n## Part 7—Effectiveness\n\n#### 7.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must operate effectively, and therefore:\n     the scope of the matters that can be dealt with under the procedures must be appropriate;\n     the operation of the procedures must be regularly reviewed by an independent person.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;\n     the procedures operate as intended.\n\n#### 7.2 Scope of complaint‑handling procedures\n\n  (1) The complaint‑handling procedures must set out clearly:\n    (a) the scope of the matters that can be dealt with under the procedures; and\n    (b) the powers and functions of the independent adjudicator.\n  (2) The scope of the matters that can be dealt with under the procedures must be broad enough to ensure that as many complaints as possible in relation to the relevant industry can be dealt with under the procedures.\n\n#### 7.3 Internal complaints mechanism\n\n  (1) The complaint‑handling procedures must ensure that each organisation that is bound by the relevant privacy code establishes an internal complaints mechanism for the purpose of dealing with complaints.\n\n> Note: Information in relation to the establishment of an internal complaints mechanism is set out in the standard made by Standards Australia entitled Standard on Complaints Handling AS 4269‑1995.\n\n  (2) The procedures must ensure that an independent adjudicator and the complaint‑handling staff for a privacy code have the capacity to give information and advice to a participating organisation about the operation of its internal complaints mechanism.\n\n#### 7.4 Compliance with complaint‑handling procedures\n\n  The complaint‑handling procedures must ensure that appropriate mechanisms are established for the purpose of encouraging participating organisations to comply with the procedures.\n\n> Note: Example: A participating organisation may be encouraged to comply with complaint‑handling procedures if it has undertaken in writing to do so, or if it will be named in an annual report, or other document, for failing to do so.\n\n#### 7.5 Independent review of complaint‑handling procedures\n\n  (1) The complaint‑handling procedures must provide for the operation of the procedures to be reviewed by an independent person within 3 years after the establishment of the procedures and regularly after that time.\n  (2) The person conducting a review must do so in consultation with relevant stakeholders.\n  (3) The person conducting a review must consider the following matters in relation to the procedures:\n    (a) whether the standards set out in this Schedule have been complied with in dealing with complaints;\n    (b) whether the scope of the matters that can be dealt with is appropriate;\n    (c) whether complainants and participating organisations are satisfied with the operation of the procedures;\n    (d) whether the methods and techniques used for dealing with complaints are just and reasonable;\n    (e) whether individuals are able to access the procedures on an equitable basis.\n  (4) The person conducting a review must make the results and findings of the review available to relevant stakeholders.","sortOrder":53},{"sectionNumber":"7.1","sectionType":"section","heading":"Overview","content":"#### 7.1 Overview\n\nPrinciple\n\n  Complaint‑handling procedures must operate effectively, and therefore:\n     the scope of the matters that can be dealt with under the procedures must be appropriate;\n     the operation of the procedures must be regularly reviewed by an independent person.\n\nPurpose\n\n  The purpose of this Part is to ensure that:\n     individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;\n     the procedures operate as intended.","sortOrder":54},{"sectionNumber":"7.2","sectionType":"section","heading":"Scope of complaint‑handling procedures","content":"#### 7.2 Scope of complaint‑handling procedures\n\n  (1) The complaint‑handling procedures must set out clearly:\n    (a) the scope of the matters that can be dealt with under the procedures; and\n    (b) the powers and functions of the independent adjudicator.\n  (2) The scope of the matters that can be dealt with under the procedures must be broad enough to ensure that as many complaints as possible in relation to the relevant industry can be dealt with under the procedures.","sortOrder":55},{"sectionNumber":"7.3","sectionType":"section","heading":"Internal complaints mechanism","content":"#### 7.3 Internal complaints mechanism\n\n  (1) The complaint‑handling procedures must ensure that each organisation that is bound by the relevant privacy code establishes an internal complaints mechanism for the purpose of dealing with complaints.\n\n> Note: Information in relation to the establishment of an internal complaints mechanism is set out in the standard made by Standards Australia entitled Standard on Complaints Handling AS 4269‑1995.\n\n  (2) The procedures must ensure that an independent adjudicator and the complaint‑handling staff for a privacy code have the capacity to give information and advice to a participating organisation about the operation of its internal complaints mechanism.","sortOrder":56},{"sectionNumber":"7.4","sectionType":"section","heading":"Compliance with complaint‑handling procedures","content":"#### 7.4 Compliance with complaint‑handling procedures\n\n  The complaint‑handling procedures must ensure that appropriate mechanisms are established for the purpose of encouraging participating organisations to comply with the procedures.\n\n> Note: Example: A participating organisation may be encouraged to comply with complaint‑handling procedures if it has undertaken in writing to do so, or if it will be named in an annual report, or other document, for failing to do so.","sortOrder":57},{"sectionNumber":"7.5","sectionType":"section","heading":"Independent review of complaint‑handling procedures","content":"#### 7.5 Independent review of complaint‑handling procedures\n\n  (1) The complaint‑handling procedures must provide for the operation of the procedures to be reviewed by an independent person within 3 years after the establishment of the procedures and regularly after that time.\n  (2) The person conducting a review must do so in consultation with relevant stakeholders.\n  (3) The person conducting a review must consider the following matters in relation to the procedures:\n    (a) whether the standards set out in this Schedule have been complied with in dealing with complaints;\n    (b) whether the scope of the matters that can be dealt with is appropriate;\n    (c) whether complainants and participating organisations are satisfied with the operation of the procedures;\n    (d) whether the methods and techniques used for dealing with complaints are just and reasonable;\n    (e) whether individuals are able to access the procedures on an equitable basis.\n  (4) The person conducting a review must make the results and findings of the review available to relevant stakeholders.","sortOrder":58}],"analysis":{"kimi_summary":{"_metrics":{"model":"kimi-k2.5","source":"moonshot-realtime","completionTokens":3117},"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":true,"description":"The regulations have expanded substantially beyond their original 2001 scope. Initially focused on basic complaint-handling standards for privacy codes and prescribing a limited number of state authorities, they now include residential tenancy database operators (added 2004) and extensive provisions for Centrelink Confirmation eServices (added 2010s). The addition of Schedules 3, 4, and 5 authorising over 200 private organisations to access government identifiers for electronic verification represents a significant expansion into digital identity matching and data sharing that was not contemplated at commencement."},"complexity_factors":["Extensive cross-referencing to the Privacy Act 1988 (sections 6E, 6F, 7A, 18BB, 52, 55A, 88) and National Privacy Principles (NPP 7.1, 7.2)","Schedule 1 contains seven distinct thematic parts governing complaint-handling procedures (Accessibility, Independence, Fairness, Accountability, Efficiency, Effectiveness) with granular operational requirements","Multiple conditional exceptions to privacy principles regarding sensitive identifiers, requiring analysis of three cumulative elements: (a) prescribed organisation, (b) prescribed identifier, and (c) prescribed circumstance","Technical definitions including 'payroll contractor', 'third party' (in complaint contexts), and various government payment identifiers","Lengthy schedules prescribing over 200 specific organisations by legal name and ABN for different verification services (Customer Confirmation, Income Confirmation, Superannuation Confirmation)"],"plain_english_summary":"This regulation under the Privacy Act 1988 clarifies how private‑sector privacy law works in practice, bringing certain small businesses (notably residential tenancy database operators) and specified NSW/Commonwealth bodies into coverage. It sets mandatory complaint‑handling standards requiring independent adjudicators and accessible, fair processes.\n\nIt also creates narrow exceptions allowing approved organisations to use government ID numbers, with consent, to verify identity or eligibility via Centrelink systems — balancing privacy protections with practical, timely service delivery."}},"importantCases":[],"_links":{"self":"/api/acts/privacy-private-sector-regulations-2001","history":"/api/acts/privacy-private-sector-regulations-2001/history","analysis":"/api/acts/privacy-private-sector-regulations-2001/analysis","conflicts":"/api/acts/privacy-private-sector-regulations-2001/conflicts","importantCases":"/api/acts/privacy-private-sector-regulations-2001/important-cases","documents":"/api/acts/privacy-private-sector-regulations-2001/documents"}}