Steps to follow

Date completed

Preliminary steps

1. Is the correspondence about a person's personal information?[1]

• ☐ Yes - treat the correspondence as a privacy complaint, and go to Question 2.
• ☐ No - follow the organisation's usual complaint handling procedures.

2. Is the information about the person who wrote the correspondence?

• ☐ Yes - go to Question 3.
• ☐ No - do you know if the writer is the representative of the person whose information is concerned in the correspondence[2]?

• ☐ Yes - go to Question 3.

• ☐ No - you should clarify the writer's authority to act either in writing or by telephone. If you proceed without the proper authority, there is a risk that you will be disclosing personal information and that you may be in breach of NPP 2 and NPP 4.

3. Does the complaint involve any of the following?[3]

• ☐ Collection of the complainant's personal information (NPP 1).
• ☐ Collection of the complainant's sensitive information (NPP 10).
• ☐ Security or storage of the complainant's personal information (NPP 4).
• ☐ Refusal to give the complainant access or find out about their personal information (NPP 6).
• ☐ Refusal to change or delete their personal information (NPP 6).
• ☐ Accuracy of the complainant's personal information (NPP 3).
• ☐ Use and/or disclosure of the complainant's personal information (NPP 2).
• ☐ Other/unsure - if this is the case, go back to the complainant and seek further information. If the complaint does not involve a matter to which the NPPs apply, consider whether the matter may be dealt with under the organisation's usual complaint handling procedures.

4. Appoint an investigating officer

This should not be someone who was involved in the conduct complained about[4].

• ☐ Insert the investigating officer's name here:

     ............................................................................

5. Contact the complainant, either by telephone or in writing, stating:

• ☐ Your understanding of the conduct complained about.
• ☐ Your understanding of the NPPs at issue (if appropriate).
• ☐ That the organisation is conducting an investigation (if appropriate).
• ☐ The name, title, and contact details of the investigating officer.
• ☐ How the investigating officer is independent of the person/s responsible for the alleged conduct.
• ☐ The estimated completion date for the investigation process.
• ☐ A request that the complainant outline what they expect as an outcome.

Now you can start the investigation                                          

6. Issues for consideration:

• ☐ Does it appear that the alleged conduct occurred?
• ☐ Was the information collected by the organisation for inclusion in a record or a generally available publication?
• ☐ Was or is the information held by the organisation in a record?

• ☐ If so, did the organisation comply with the NPPs when dealing with the information?

7. Preliminary findings about the facts and the application of the law to the facts:

• ☐ Is there sufficient evidence to establish that the matters complained about actually occurred?

For example, this may include the disclosure of information to a third party, use of personal information for a secondary purpose or failure to secure personal information.

• ☐ Which of the NPPs may be relevant and why?
• ☐ Does it appear that the conduct, decision or omission complied with the NPPs?

• ☐ If not, was non-compliance permitted by an exception or an exemption under the Act?
• ☐ If an exception or an exemption does not apply, consider whether the complainant's requests regarding outcomes can be met.

This may include an apology, a change in procedures, improvement of security safeguards or payment of compensation for loss or damage suffered.

Communication with the complainant

8. Write to and, if possible, call the complainant providing:

• ☐ Your decision.

Include as much detail about the investigation as possible.

• ☐ An invitation for the complainant to respond to your decision and if appropriate, the offer of a meeting.
• ☐ An apology if you did not comply with the relevant NPPs and consider whether any further remedy is appropriate. Consider whether a meeting to discuss the possible outcomes would assist, or whether it might be possible to resolve the matter by mediation.

9. Complainant's response

• ☐ Assess any response from the complainant.

• ☐ If you initially found that the organisation did comply with the NPPs, does the complainant's response alter your view?
• ☐ Are further discussions needed?
• ☐ If the organisation did not comply with the relevant NPPs would an external mediator be helpful?

• ☐ If the complainant remains unsatisfied with the outcome, refer the complainant to the Office of the Privacy Commissioner.

Systemic issues

10. Consider whether the complaint raises any systemic issues, such as:

• ☐ Privacy training.
• ☐ Amendment of forms and/or collection notices.
• ☐ Improve security and storage measures.
• ☐ Steps to improve data accuracy.

Make a record of any changes made.

Evaluate the changes by reviewing against any future privacy complaints.

Finalisation

11. Storage

• ☐ When finalised, the record of the complaint and the investigation should be stored securely (NPP 4) and in accordance with record keeping requirements.

When responding to requests for information from the Office of the Privacy Commissioner, you may wish to use the investigation report and related documents as appropriate.