How does the Privacy Commissioner investigate a privacy breach?

When you believe that your privacy has been breached or interfered with, you can make a complaint to the Office of the Privacy Commissioner (OPC). The OPC may investigate any action that appears to be, or is, an interference with privacy, and will then attempt to resolve the complaint.

When the OPC conducts an investigation into an alleged breach of, or interference with, privacy under the Privacy Act 2020, they:

1. Receive and screen the complaint;
2. Investigate the complaint;
3. Form a view on whether there was an interference with privacy; and
4. Attempt to resolve the complaint.

Complaints about privacy breaches that occurred under the previous Privacy Act 1993 (which was in force until 1 December 2020) cannot be resolved by the OPC - which only had investigative powers under the old legislation. 

If a breach or privacy interference occurred while the previous legislation was in force, the OPC will issue a certificate that allows the complainant to take the matter to the Human Rights Review Tribunal for further action.

Receiving and screening the complaint

Once a complaint about a breach of, or interference with, privacy is received, an investigator from the OPC will determine whether they are able to investigate. If the OPC can investigate, the investigator must consider whether they should nonetheless decline to investigate. Reasons a complaint may not be investigated include:

• The length of time since the alleged breach of, or interference with, privacy occurred;
• If the complaint is trivial, frivolous, or not made in good faith; or
• If the complaint may be better dealt with by another agency, for example the Ombudsman if it is really an official information matter, in which case it may be referred on.

Investigating the complaint

Once the relevant parties have been notified of the investigation, the investigator will determine which of the information privacy principles have been breached and how. When investigating a complaint, the investigator will talk with the parties involved, and collate information that is relevant to the complaint.

The process that is taken will depend on the circumstances of each case, for example it may include a conciliation conference where the parties are brought together to talk about what took place.

Forming a view on whether there was an interference of privacy

At this stage, the investigator will assess the facts and the parties’ responses in order to form a view. If the investigator forms a view against one party, they will get a right of response. The view that is reached will indicate whether an interference with privacy occurred. Once a decision is made, the investigator will notify the parties of the result.

Resolving the complaint:

Settling disputes is the main goal of the OPC when investigating a privacy complaint. Settlements often include an apology, an assurance the breach will not be repeated, a promise to take actions that will prevent breaches in the future, compensation, and/or the release of the information that was requested (if relevant). The OPC will mediate with the parties when they are trying to reach an appropriate settlement.

If you believe that your privacy has been breached or interfered with, but are unsure about how to make a complaint to the Office of the Privacy Commissioner, speak with an experienced professional who can help you throughout the investigation process.

Leading law firms committed to helping clients cost-effectively will have a range of fixed-price Initial Consultations to suit most people’s needs in quickly learning what their options are.  At Rainey Collins we have an experienced team who can answer your questions and put you on the right track.