13Investigations of breaches of privacy

#### 13 Investigations of breaches of privacy (1) In this section: > Commissioner means the Information Commissioner acting in the performance of the privacy functions (within the meaning of the Australian Information Commissioner Act 2010). (2) The Commissioner may investigate any act or practice which might be a breach of this Act or the rules issued under section 12. (3) Where the Commissioner finds that an investigated act or investigated practice of the matching agency or a source agency was in breach of this Act or the rules, the Commissioner and the agency must endeavour to make arrangements satisfactory to the Commissioner in relation to the act or practice. (4) Where the Commissioner finds that an act, or practice, investigated was in breach of this Act or the rules and arrangements have not been made under subsection (3) or the Commissioner considers a report under this subsection appropriate in all the circumstances, the Commissioner: (a) must make a report to the Minister about the act or practice; and (b) must set out in the report the Commissioner’s findings and the reasons for those findings; and (c) may include in the report any recommendations by the Commissioner for preventing repetition of the act or a continuation of the practice; and (d) may include in the report any recommendation by the Commissioner for either or both of the following: (i) the payment of compensation in respect of a person who has suffered loss or damage as a result of the act or practice; or (ii) the taking of other action to remedy or reduce loss or damage suffered by a person as a result of the act or practice; and (e) must serve a copy of the report on the matching agency, any source agency concerned in the act or practice and the Minister responsible for such a source agency; and (f) may serve a copy of the report on any person affected by the act or practice. (5) Where, at the end of 60 days after a copy of a report about an act or practice was served under subsection (4), the Commissioner is not satisfied that reasonable steps have been taken to prevent a repetition of the act or a continuation of the practice, the Commissioner must give to the Minister a further report that: (a) incorporates the earlier report and any background information that the Commissioner has received from an agency in response to the earlier report; and (b) states whether, to the knowledge of the Commissioner, any action has been taken as a result of the findings and recommendations (if any) set out in the earlier report, and if so, the nature of that action; and (c) states why the Commissioner is not satisfied that reasonable steps have been taken to prevent a repetition of the act or a continuation of the practice; and, where the second report relates to an agency other than an agency administered by the Minister, must give a copy of the report to the Minister responsible for the agency. (6) The Minister is to cause a copy of the report given under subsection (5) to be laid before each House of the Parliament within 15 sitting days of that House, after the report is received by the Minister. (7) In conducting an investigation under this section, the Commissioner has all the powers of investigation that he or she has under Part V of the Privacy Act 1988. > Note: In addition, under paragraphs 80TB(1)(b) and (3)(b) of the Privacy Act 1988, the Commissioner has the power to monitor, under the Regulatory Powers Act, compliance with this Act or rules issued under section 12\. See also paragraph 33C(1)(d) of that Act. (8) Nothing in this section or in any other provision of this Act limits the rights of persons under the Privacy Act 1988 to complain to the Commissioner about interference with privacy.