The Bill provides for appointment of an Information Privacy Commissioner. (Prior to March 2014 the Commonwealth Privacy Commissioner and Australian Information Commissioner had the function under the Privacy Act 1988 (Cth).
The Commissioner position has a statutory basis. The Bill is silent on the structure and shape of the Commissioner's office.
The appointment must not be for more than 7 years. Clause 28 of the Bill provides that if the ACT Government does not appoint a person as Information Privacy Commissioner it may enter into arrangement with another Commonwealth, state or territory information or privacy commissioner (however described) to exercise one or more of the ACT Commissioner's functions. The Explanatory Statement notes that
This clause allows the ACT to arrange with another jurisdiction to exercise one or more of the commissioner functions, such as privacy complaints resolution, privacy investigation and breach monitoring and auditing services.. Such arrangements must be adopted until such time as the Executive appoints a person as the Information Privacy Commissioner.Earlier this year I noted concerns regarding the Government's plan to use the Territory Ombudsman (who spends most of the time as the Commonwealth Ombudsman) as the ACT "Information Commissioner", ie dealing with the ACT Freedom of Information regime.
It is a recipe for administrative overload and underperformance, so let us hope that the Commonwealth Ombudsman doesn't end up acting as the Territory Information Privacy Commissioner or that the OAIC ends up with the Territory's privacy role.
The Commissioner's functions are identified in clause 29 of the Bill. They are to -
(a) promote an understanding of the TPPs and the objects of the TPPs; and
(b) provide information and educational programs to promote the protection of the privacy of individuals; and
(c) help public sector agencies to comply with the TPPs and TPP codes; and
(d) investigate privacy complaints made under this Act; and (e) exercise any other functions given to the commissioner under this Act or another territory law.Under the Bill a privacy complaint may be referred to the Commissioner by the Ombudsman, the Human Rights Commission, or any entity equivalent to the Commissioner regulating privacy in another Australian jurisdiction. Additional entities that may refer a privacy complaint can be prescribed by regulation.
The Bill provides that a privacy complaint must be in writing, and include the complainant’s name, address, telephone number, the identity of the entity that is the subject of the complaint and details about the act or practice that is the subject of the complaint. A privacy complaint may be made orally if the Commissioner is reasonably satisfied that there are exceptional circumstances (eg if the person is unable to write in English or has other communication difficulties).
In dealing with privacy complaints the Commissioner may make preliminary inquiries of the public sector agency that is the subject of the complaint, as well as any other person. It is intended that the Commissioner will only make inquiries of third parties when satisfied that this approach will result in more timely and efficient complaint resolution. The Information Privacy Commissioner may decide not to deal with a complaint if reasonably satisfied that -
a) the act or practice complained about is not an interference with an individual’s privacy;
b) the complaint was made more than 12 months after the complainant became aware of the act or practice;
c) the complaint is frivolous, vexatious, misconceived, lacking in substance or not made in good faith;
d) the act or practice is the subject of an application under another Australian law, and the substance of the complaint has been, or is being, dealt with adequately under that law;
e) the complaint would be better dealt with under another Australian law;
f) dealing, or further dealing, with the act or practice is not warranted having regard to all the circumstances;
g) the complainant has complained to the respondent about the act or practice and i) the respondent has dealt, or is dealing, adequately with the complaint, or ii) the respondent has not yet had an adequate opportunity to deal with the complaint.The Commissioner may decide not to continue dealing with a complaint, or part of a complaint if -
a) the complainant does not comply with a reasonable request made by the Commissioner in dealing with the complaint, or part of the complaint; or
b) the Commissioner is reasonably satisfied that the complainant, without reasonable excuse, has not co-operated in the Commissioner’s dealing with the complaint, or part of the complaint; or
c) the Commissioner has not been able to contact the complainant for a reasonable period of time using the contact details in the privacy complaint.Importantly the Commissioner can refer a privacy complaint to another investigative entity with power to investigate the complaint, if reasonably satisfied that the complaint would be better dealt with by that entity. The Bill refers to the Ombudsman, the Human Rights Commission, and any equivalent body regulating privacy in other Australian jurisdictions; other entities could be prescribed by regulation.
The Bill requires that where the Commissioner is reasonably satisfied that there has been an interference with the complainant’s privacy the parties must be told that application may be made to court and that the complainant may apply to a court for an order.
Clause 47 of the Bill specifies the types of orders that the court may make to resolve a privacy complaint which has been determined to involve an interference with an individual’s privacy -
a) an order that the complaint, or part of the complaint, has been substantiated, together with, if appropriate, one or more of the following orders:
i) that an act or practice of the respondent is an interference with the privacy of the complainant and that the respondent must not repeat or continue the act or practice;
ii) that the respondent must engage in a stated reasonable act or practice to compensate for loss or damage suffered by the complainant;
iii) that the respondent must make a stated amendment of a record it holds;
iv) that the complainant is entitled to a stated amount, of not more than $100,000, to compensate the complainant for economic loss or damage suffered by the complainant because of the act or practice complained of;
b) an order that the complaint, or part of the complaint, has been substantiated together with an order that no further action is required to be taken;
c) an order that the complaint, or part of the complaint, has not been substantiated, together with an order that the complaint or part is dismissed;
d) an order than the complainant be reimbursed for expenses reasonably incurred in relation to making the complaint.
