What can I do if I think my privacy has been breached by a government agency?

In Plain English

If you believe a government agency has mishandled your personal information, here's what you can do:

  1. Make a Complaint: You can complain to the Information Commissioner about the agency's actions. Your complaint needs to be in writing and identify the agency you're complaining about. The Office of the Australian Information Commissioner can help you put your complaint together.
  2. Investigation: The Information Commissioner will then investigate the matter.
  3. Report: If the Information Commissioner finds that your privacy has been breached, they will report this and make recommendations to prevent it from happening again.

Detailed Explanation

If you believe that a government agency has breached your privacy, you have several avenues for recourse under Australian law.

  1. Complaint to the Information Commissioner:
    • Under the Crimes Act 1914, specifically section 85ZZA, you have the right to complain to the Information Commissioner about actions that may breach Division 2 or 3 of the Act, which relate to privacy.
    • The complaint must be in writing, as specified in section 85ZZA(2) of the Crimes Act 1914.
    • The complaint should identify the specific agency involved (respondent), as per section 85ZZA(4) of the Crimes Act 1914. Section 85ZZB of the Crimes Act 1914 clarifies who the respondent should be based on the type of agency.
    • The Office of the Information Commissioner is obligated to provide assistance in formulating the complaint, according to section 85ZZA(3) of the Crimes Act 1914.
  2. Investigation by the Information Commissioner:
    • The Information Commissioner is required to consider the complaint and investigate the alleged breach, as stated in section 85ZZC(1) of the Crimes Act 1914, if the act or practice may be a breach of Division 2 or 3.
    • However, the Information Commissioner has the discretion not to investigate or further investigate if certain conditions are met, such as the complaint being frivolous, the issue already being adequately dealt with, or the complaint being made too late (more than 12 months after awareness of the breach), as outlined in section 85ZZC(2) of the Crimes Act 1914.
  3. Data-matching Program (Assistance and Tax) Act 1990:
    • Under the Data-matching Program (Assistance and Tax) Act 1990, section 13(2), the Information Commissioner may investigate any act or practice which might be a breach of this Act or the rules issued under section 12.
    • If the Information Commissioner finds a breach, they must endeavour to make satisfactory arrangements with the agency involved (section 13(3)).
    • If satisfactory arrangements cannot be made, the Information Commissioner must make a report to the Minister, including findings, reasons, and recommendations for preventing repetition or providing compensation (section 13(4)).
    • The Minister is required to table a copy of the report before each House of Parliament (section 13(6)).
  4. Complaints under the Privacy Act 1988:
    • Section 14 of the Data-matching Program (Assistance and Tax) Act 1990 states that a breach of Part 2 of this Act or the rules referred to in section 12 constitutes an act or practice involving interference with the privacy of an individual for the purposes of section 13 of the Privacy Act 1988.
    • An individual may complain to the Information Commissioner about an act or practice in relation to the operation of this Act which may be an interference with the privacy of the individual.
    • In the event of a complaint being made by an individual, it shall be dealt with in accordance with the provisions of Part V of the Privacy Act 1988, which shall apply mutatis mutandis to this Act.