Schedule 1—Privacy codes—prescribed standards for procedures relating to complaints
(regulation 5)
Part 1—General
1.1 Object
(1) This Schedule sets out the standards that must be met by complaint‑handling procedures that are set out in a privacy code.
(2) The standards apply to complaints that are made to an independent adjudicator who is appointed under the code.
1.2 Definitions
In this Schedule, unless the contrary intention appears:
complaint means a complaint that is made by an individual about an act or practice of an organisation that may be an interference with the privacy of the individual.
independent adjudicator means the person who is appointed under a privacy code as an independent person to whom a complaint may be made.
Note: The Australian Information Commissioner may be appointed as an independent adjudicator under a privacy code.
participating organisation, in relation to a privacy code, means an organisation that is bound by the code.
respondent organisation, in relation to a complaint, means the participating organisation against whom the complaint is made.
Part 2—Accessibility
2.1 Overview
Principle
Complaint‑handling procedures must:
be readily available to any individual about whom a participating organisation holds personal information;
be promoted widely;
be easy to use;
be able to be used by complainants without any charge or fee.
Purpose
The purpose of this Part is to ensure that complaint‑handling procedures are accessible, on an equitable basis, to any individual about whom a participating organisation holds personal information.
2.2 Procedures to be in writing
(1) The complaint‑handling procedures must be in writing.
(2) The procedures must be clearly expressed and must deal with the following matters:
(a) how to make a complaint;
(b) how a complaint will be dealt with;
(c) the kind of complaints that can be dealt with under the procedures;
(d) any restrictions on the kind of complaints that can be dealt with under the procedures.
2.3 Awareness and promotion
(1) The existence of the complaint‑handling procedures must be promoted as widely as possible to the class or classes of individuals to whom it is relevant, using news media or any other appropriate means.
(2) The methods used for promoting the existence of the procedures must be appropriate for all individuals, and, in particular, must be sensitive to the needs of individuals with disabilities and disadvantaged individuals (for example, those who cannot read or write).
2.4 Copies of procedures to be made available
(1) A copy of the complaint‑handling procedures must be readily available:
(a) to a complainant, as soon as practicable after the complaint is made; and
(b) to anyone else who asks for it.
(2) The procedures must ensure that a participating organisation is compelled to give a copy of the complaint‑handling procedures to an individual if:
(a) the individual has complained to the organisation about an act or practice of the organisation that may be an interference with the privacy of the individual; and
(b) any of the following occurs:
(i) the complaint is dealt with in accordance with the organisation’s internal complaints mechanism (whether or not the individual is satisfied with the outcome);
(ii) the organisation refuses to deal with the complaint;
(iii) the organisation does not deal with the complaint in the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, or in accordance with the organisation’s internal complaints mechanism.
(3) If an organisation is required to give a copy of the complaint‑handling procedures to an individual under subclause (2), the organisation must give the copy to the individual, as the case requires:
(a) when the individual’s complaint has been dealt with; or
(b) when the decision to refuse to deal with the individual’s complaint is made; or
(c) at the end of the time when the individual’s complaint should have been dealt with.
2.5 Access to procedures
(1) The complaint‑handling procedures must be accessible to any individual about whom a participating organisation holds personal information, regardless of where the individual is located.
Note: Example: Access to the complaint‑handling procedures may be provided by a toll‑free telephone service or by sending a copy of the procedures to an individual.
(2) The procedures must ensure that appropriate facilities and assistance are provided for individuals with disabilities and disadvantaged individuals.
(3) The procedures must ensure that an individual may contact a participating organisation in relation to a possible complaint orally or in writing.
(4) The procedures must require a complaint to be made in writing.
Note: Appropriately trained staff must, if necessary, assist a complainant to prepare a complaint in writing—see subclause 2.7(3) of this Schedule.
2.6 Cost
A complainant must not be charged a fee for making a complaint or having a complaint dealt with.
2.7 Complaint‑handling staff
(1) A complaint must be handled by staff with the appropriate ability and training.
(2) The complaint‑handling staff must explain the following matters to a complainant as simply as possible:
(a) how a complaint will be dealt with;
(b) the matters that will be dealt with in relation to a complaint;
(c) any restrictions on the matters that will be dealt with in relation to a complaint;
(d) the expected time needed for each process to be carried out in dealing with the complaint.
(3) The complaint‑handling staff must assist a complainant to prepare a written complaint if the complainant needs such assistance.
2.8 Methods for dealing with complaints
(1) The complaint‑handling procedures must be as simple as possible for complainants to understand and use.
(2) In particular, a complaint must be dealt with:
(a) using appropriate methods and techniques (including conciliation, mediation and negotiation); and
(b) with as little formality and technicality, and with as much expedition, as a proper consideration of the complaint permits.
2.9 Presentation of complainant’s case
(1) The independent adjudicator must decide whether the complainant’s case in relation to the complaint is to be presented orally or in writing.
(2) The adjudicator must permit another person to support the complainant at any time while the complaint is being dealt with.
2.10 Representation of complainant by legal practitioner
(1) The complainant, or the respondent organisation, may be represented by a legal practitioner only if:
(a) the complainant or respondent organisation makes a request to the adjudicator to be legally represented; and
(b) the adjudicator considers that special circumstances exist in relation to the complaint.
(2) If either party, being the complainant or the respondent organisation, is represented by a legal practitioner, the other party may also be represented by a legal practitioner.
(3) If:
(a) the respondent organisation requests that it be represented by a legal practitioner; and
(b) after that request, the complainant requests that he or she be represented by a legal practitioner; and
(c) the adjudicator grants both requests;
the respondent organisation must pay the complainant’s legal costs.
Part 3—Independence
3.1 Overview
Principle
The administration of, and process of making determinations under, the complaint‑handling procedures must be independent from all participating organisations.
Purpose
The purpose of this Part is to ensure that all processes carried out under the complaint‑handling procedures, and all determinations made under the procedures, are carried out or made in an objective and unbiased way and are seen to be carried out, or made, in an objective and unbiased way.
3.2 Independent adjudicator
(1) A person who is appointed as an independent adjudicator under a privacy code must be appointed for a fixed term.
(2) An adjudicator for a privacy code must not be selected directly by any organisation that is bound by that code.
(3) An adjudicator must not be answerable to any participating organisation in relation to his or her determinations, except as otherwise provided by the standards set out in this Schedule.
(4) An adjudicator must not have any relationship with any participating organisation that could give rise to a perceived or actual conflict of interest in relation to the performance of the adjudicator’s functions.
3.3 Complaint‑handling staff
(1) The complaint‑handling staff for a privacy code must not be selected directly by any organisation that is bound by that code.
(2) The complaint‑handling staff must not be answerable to any participating organisation in relation to the operation of the complaint‑handling procedures, except as otherwise provided by the standards set out in this Schedule.
3.4 Overseeing entity
(1) The complaint‑handling procedures must ensure that the operation of the procedures is formally overseen by an overseeing entity consisting of as many members as are appropriate to provide a balance of representation of the interests of the following groups:
(a) the class or classes of individuals to whom the procedures are relevant (the relevant individuals);
(b) the relevant industry;
(c) if appropriate, other relevant stakeholders.
(2) A person who is appointed as a member of the overseeing entity to represent the interests of the relevant individuals must be a person:
(a) who is capable of reflecting the views and concerns of the relevant individuals; and
(b) in whom the relevant individuals and any relevant organisations have confidence.
(3) The procedures must ensure that the overseeing entity has the following functions:
(a) to appoint or dismiss an independent adjudicator under the relevant privacy code;
(b) to make recommendations in relation to, and approve, the budget for the operation of the procedures.
3.5 Funding
The participating organisations must ensure that sufficient funding is made available to enable complaints to be dealt with under the complaint‑handling procedures in accordance with:
(a) the standards set out in this Schedule; and
(b) the Privacy Act 1988; and
(c) any guidelines made by the Commissioner under paragraph 18BF(1)(b) of that Act.
Part 4—Fairness
4.1 Overview
Principle
Determinations made under complaint‑handling procedures must be fair, and must be seen to be fair, and therefore:
investigations of complaints must be conducted with procedural fairness;
determinations must be made on the basis of information before an independent adjudicator;
determinations must be made on the basis of specific criteria.
Purpose
The purpose of this Part is to ensure that determinations made under complaint‑handling procedures are fair and are seen to be fair.
4.2 Complainant to be informed of rights
The complaint‑handling staff for a privacy code must inform a complainant of his or her rights under the code and the Privacy Act 1988 in relation to:
(a) a decision that is made by the complaint‑handling staff in dealing with the complaint; or
(b) a determination of an independent adjudicator.
Note: See section 18BI of the Act, which provides for review by the Commissioner of an independent adjudicator’s determination, and section 55A of the Act, which provides for a proceeding to be commenced in the Federal Court or the Federal Circuit Court for an order to enforce a determination.
4.3 Investigation to be conducted with procedural fairness
(1) An investigation of a complaint must be conducted with procedural fairness.
(2) In particular, each party to the complaint, being the complainant and the respondent organisation, must:
(a) be given sufficient information about the case being presented by the other party; and
(b) be given a reasonable opportunity to be heard and to respond to anything raised by the other party.
4.4 Power of adjudicator to obtain information or documents
(1) If an independent adjudicator has reason to believe that a complainant has information or a document relevant to an investigation of a complaint:
(a) the adjudicator may give the complainant a written notice requesting the complainant to give the information or document to the adjudicator; and
(b) the complainant may, but must not be compelled to, give the information or document to the adjudicator.
(2) If an independent adjudicator has reason to believe that a participating organisation has information or a document relevant to an investigation of a complaint:
(a) the adjudicator may give the organisation a written notice requesting the organisation to give the information or document to the adjudicator; and
(b) subject to subclauses (3) and (4), the organisation must give the information or document to the adjudicator.
(3) A participating organisation is not required to give information, or a document, that contains identifying material about a third party to the adjudicator unless the third party has given permission for the information or document to be given to the adjudicator (whether in full or with the identifying material deleted or otherwise removed).
(4) A participating organisation is not required to give information or a document to the adjudicator if the organisation is prohibited under a law of the Commonwealth, or of a State or Territory, from disclosing the information or the contents of the document.
(5) If a participating organisation gives information, or a document, that contains identifying material about a third party to the adjudicator, the information or document may, at the discretion of the adjudicator, be given to the complainant with the identifying material deleted or otherwise removed.
(6) In this clause:
third party, in relation to a complaint, means a person, other than the complainant or the respondent organisation to the complaint, to whom the respondent organisation owes a duty of confidentiality or privacy.
4.5 Determinations of independent adjudicator
(1) A determination made by an independent adjudicator in relation to a complaint must be fair and reasonable, having regard to the following:
(a) good industry practice;
(b) any relevant industry code of practice;
(c) the privacy code under which the adjudicator was appointed;
(d) any previous determinations made in relation to similar complaints;
(e) any relevant law.
Note: The determinations, findings, declarations, orders and directions that the adjudicator may make under the relevant privacy code after investigating a complaint are the same as those that the Commissioner may make under section 52 of the Act after investigating a complaint under the Act—see paragraph 18BB(3)(d) of the Act.
(2) As soon as practicable after making a determination in relation to a complaint, an independent adjudicator must inform the complainant and the respondent organisation of the determination and the reasons for the determination.
4.6 Confidentiality
(1) Any information or document that is provided to an independent adjudicator for the purpose of investigating a complaint must be kept confidential, unless the information or document is required to be disclosed under a law of the Commonwealth, or of a State or Territory, or under any other standard set out in this Schedule.
(2) The procedures must ensure that the complainant and the respondent organisation undertake not to disclose any information that is gained in the course of having a complaint dealt with (for example, during any mediation, conciliation or negotiation), unless the information is required to be disclosed under a law of the Commonwealth, or of a State or Territory.
Part 5—Accountability
5.1 Overview
Principle
The operation of complaint‑handling procedures must be publicly accountable. Reports of determinations and information about complaints must be published and made available.
Purpose
The purpose of this Part is to ensure that:
the public have confidence in the operation of the complaint‑handling procedures;
provision is made for the assessment and improvement of the operation of the procedures and the performance of participating organisations in relation to the collection of personal information.
5.2 Reports of determinations
(1) Written reports of determinations by an independent adjudicator must:
(a) be given, on a regular basis, to each organisation that is bound by the relevant privacy code; and
(b) be made available to any other interested person or body.
(2) A report must give an account of any determination that the adjudicator considers it appropriate to report on for the purpose of educating participating organisations and individuals, and demonstrating consistency and fairness in determining complaints.
(3) A report may include a concise summary of a determination and the reasons for the determination, but need not include all the evidence and arguments presented in relation to the complaint.
(4) A report must not:
(a) name any complainant or respondent organisation; or
(b) include any other personal information about a complainant or any other individual involved in the investigation of a complaint.
Part 6—Efficiency
6.1 Overview
Principle
Complaint‑handling procedures must operate efficiently, and therefore:
complaints must be dealt with using an appropriate process and forum;
complaints must be dealt with in a timely way;
the progress of complaints must be tracked.
Purpose
The purpose of this Part is to ensure that:
individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;
the operation of the procedures provides value for its funding.
6.2 Kind of complaints that can be dealt with
(1) The complaint‑handling procedures must provide that a complaint must not be dealt with under the procedures unless:
(a) the complaint is of a kind that can be dealt with under the procedures; and
(b) the complaint has not been, or is not being, dealt with by the Commissioner or in another dispute resolution forum; and
(c) the complainant has complained to the respondent organisation about the matter to which the complaint relates; and
(d) either:
(i) the complainant and the respondent organisation have attempted to settle the matter in accordance with the organisation’s internal complaints mechanism; or
(ii) the organisation has refused to deal with the matter, or has not dealt with the matter within the time specified in the guidelines made under paragraph 18BF(1)(b) of the Act, in accordance with its internal complaints mechanism.
(2) The procedures must:
(a) provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that it would be more appropriate, having regard to the matter to which the complaint relates, for the complaint to be dealt with by the Commissioner or in another dispute resolution forum; and
(b) provide a mechanism or procedure that must be used to refer such a complaint to an appropriate person for it to be dealt with.
(3) The procedures must:
(a) provide that participating organisations must be informed of any systemic problems in relation to the relevant industry that become apparent from complaints; and
(b) provide a mechanism or procedure that must be used to inform organisations of any such systemic problems.
(4) The procedures must provide that a complaint must not be dealt with under the procedures if an independent adjudicator considers that the complaint is vexatious or frivolous.
6.3 Time in which complaints must be dealt with
(1) The complaint‑handling procedures must specify reasonable time limits for each process that is required to be carried out in dealing with a complaint, so as to facilitate a resolution of the matter to which the complaint relates as quickly as practicable, but without compromising the quality of any decision or determination made in relation to the complaint.
(2) The procedures must provide a mechanism to ensure that, as far as practicable, the time limits are complied with.
6.4 Progress of complaints
(1) The complaint‑handling procedures must ensure that a system is established and used for the purpose of tracking the progress of complaints.
(2) The complaint‑handling staff must inform the complainant and the respondent organisation, in relation to a complaint, about the progress of the complaint.
Part 7—Effectiveness
7.1 Overview
Principle
Complaint‑handling procedures must operate effectively, and therefore:
the scope of the matters that can be dealt with under the procedures must be appropriate;
the operation of the procedures must be regularly reviewed by an independent person.
Purpose
The purpose of this Part is to ensure that:
individuals and participating organisations that use the complaint‑handling procedures have confidence in their operation;
the procedures operate as intended.
7.2 Scope of complaint‑handling procedures
(1) The complaint‑handling procedures must set out clearly:
(a) the scope of the matters that can be dealt with under the procedures; and
(b) the powers and functions of the independent adjudicator.
(2) The scope of the matters that can be dealt with under the procedures must be broad enough to ensure that as many complaints as possible in relation to the relevant industry can be dealt with under the procedures.
7.3 Internal complaints mechanism
(1) The complaint‑handling procedures must ensure that each organisation that is bound by the relevant privacy code establishes an internal complaints mechanism for the purpose of dealing with complaints.
Note: Information in relation to the establishment of an internal complaints mechanism is set out in the standard made by Standards Australia entitled Standard on Complaints Handling AS 4269‑1995.
(2) The procedures must ensure that an independent adjudicator and the complaint‑handling staff for a privacy code have the capacity to give information and advice to a participating organisation about the operation of its internal complaints mechanism.
7.4 Compliance with complaint‑handling procedures
The complaint‑handling procedures must ensure that appropriate mechanisms are established for the purpose of encouraging participating organisations to comply with the procedures.
Note: Example: A participating organisation may be encouraged to comply with complaint‑handling procedures if it has undertaken in writing to do so, or if it will be named in an annual report, or other document, for failing to do so.
7.5 Independent review of complaint‑handling procedures
(1) The complaint‑handling procedures must provide for the operation of the procedures to be reviewed by an independent person within 3 years after the establishment of the procedures and regularly after that time.
(2) The person conducting a review must do so in consultation with relevant stakeholders.
(3) The person conducting a review must consider the following matters in relation to the procedures:
(a) whether the standards set out in this Schedule have been complied with in dealing with complaints;
(b) whether the scope of the matters that can be dealt with is appropriate;
(c) whether complainants and participating organisations are satisfied with the operation of the procedures;
(d) whether the methods and techniques used for dealing with complaints are just and reasonable;
(e) whether individuals are able to access the procedures on an equitable basis.
(4) The person conducting a review must make the results and findings of the review available to relevant stakeholders.