Privacy complaints and Internal Review

Any person who is aggrieved by the conduct of the Department in handling personal and/or health information may lodge a privacy complaint.

The Department encourages individuals to resolve the issue directly with the relevant business unit.

If an individual remains dissatisfied, they can lodge a privacy complaint by applying for an ‘internal review’ of the conduct of the Department they believe breaches an IPP and/or a HPP.

A person can also discuss any concerns or email the Open Government Information and Privacy team on infoandprivacy@dcj.nsw.gov.au or (02) 9716-2662.

Your rights of internal review

An application for internal review should:

• be in writing;
• be addressed to the Department;
• outline how the Department has breached one or more of the IPPs;
• be lodged with the Department within 6 months from the time the applicant first became aware of the conduct the subject of the application; and
• specify an address (physical or electronic) in Australia at which you can be notified after the completion of the review.

An individual who is applying for a privacy internal review may wish to use the Department’s Application Form – Internal Review of Conduct.

Process

The internal review is conducted by a person who:

• was not involved in the conduct which is the subject of the complaint;
• is a staff member of the Department’s Legal Branch where reasonably practicable; and
• is qualified to deal with the subject matter of the complaint. OGIP employees are specially trained on dealing with complaints under the PPIP Act and will generally be the business unit responsible.

The Internal Review follows the process set out in the Information & Privacy Commission’s internal review checklist. When the internal review is completed, an applicant is notified in writing of:

• the findings of the review;
• the reasons for those findings;
• the action the Department proposes to take;
• the reasons for the proposed action (or no action); and
• the applicant’s entitlement to have the findings and the reasons for the findings reviewed by the NSW Civil and Administrative Tribunal (NCAT). The Department is also required to provide a copy of its draft internal review report to the Privacy Commissioner and consider any submissions made by the Privacy Commissioner.

The Department will keep the Privacy Commissioner informed of the progress of the internal review and will provide a copy of the finalised internal review report. Further information about the internal review process is available on the IPC website.

Timeframes

An applicant must lodge their request for internal review within six months from the time they first became aware of the conduct that they believe breached their privacy. The Department acknowledges receipt of an internal review and will aim to complete the internal review within 60 calendar days. The Department will contact an applicant if the review is likely to take longer than 60 days to complete.

The Department will contact an applicant in writing within 14 calendar days of completing the internal review. If the internal review is not completed within 60 days, or if an applicant is unhappy with the outcome of the internal review, they  have a right to seek a review of the conduct by the NCAT.

An applicant has 28 calendar days from the date of the internal review decision to seek an external review. To request an external review, an applicant must apply directly to the NCAT. To apply for an external review or to obtain more information about seeking an external review, including current forms and fees, please contact the NCAT:

Website: http://www.ncat.nsw.gov.au/
Phone:1300 006 228 or (02) 9377 5711
Visit/post: Level 9, John Maddison Tower, 86-90 Goulburn Street, Sydney NSW 2000

Other ways to resolve privacy concerns

The Department welcomes the opportunity to discuss any privacy issues an individual may have. Individuals are encouraged to try to resolve privacy issues with the relevant division or business unit within the Department informally before lodging an internal review.

Complaints to the Privacy Commissioner - Individuals have the option of complaining directly to the Privacy Commissioner if they believe that the Department has breached their privacy. The Privacy Commissioner’s contact details are:

Office: NSW Information & Privacy Commission
Level 17, 201 Elizabeth Street Sydney NSW 2000
Post: GPO Box 7011
Sydney NSW 2001
Phone: 1800 472 679
Email: ipcinfo@ipc.nsw.gov.au