Privacy complaints: Your review rights
Read the document below or download it here Fact sheet - Privacy complaints: Your review rights, updated September 2020
If you are not satisfied with the outcome of an agency’s internal review into your privacy complaint, you can apply to an independent Tribunal for external review.
About internal review
If you have a privacy complaint about the way in which a NSW public sector agency has handled your personal information and/or health information, you may ask that agency to conduct an ‘internal review’ of your privacy complaint.
An internal review is a fact finding investigation into your privacy complaint.
Your complaint must be about conduct which suggests that the agency has breached one or more privacy principles (or an exemption to the privacy principle/s such as a Privacy Code of Practice).
The privacy principles are:
- the Information Protection Principles (IPPs) in the Privacy and Personal Information Protection Act 1998 (the PPIP Act) – which relate to personal information other than health information, and
- the Health Privacy Principles (HPPs) in Schedule 1 of the Health Records and Information Privacy Act 2002 (the HRIP Act) – which relate to health information.
An internal review provides an opportunity for an agency to deal with and resolve your privacy complaint.
The review must be completed as soon as reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day the privacy complaint is received, you are entitled to make an application under section 55 of the PPIP Act to the NSW Civil and Administrative Tribunal (NCAT) for a review of the conduct concerned. An applicant may also seek a review by the NCAT if they are not satisfied with the action taken in relation to an application for an internal review.
Following the completion of an internal review, an agency may do one or more of the following:
- take no further action on the matter
- make a formal apology to you
- ensure that the conduct will not occur again (e.g. change practices and/or provide training to staff), and/or
- take appropriate remedial action (e.g. correct an inaccurate record, or pay you compensation).
You will be informed of the findings of the review, and the action proposed to be taken by the agency, if any. The internal review report should also advise you of your further review rights.
Role of the NSW Privacy Commissioner in the internal review process
An agency must keep the Privacy Commissioner informed of an internal review application and its progress, until finalised. This includes notifying the Privacy Commissioner of an application, keeping the Privacy Commissioner informed of the progress of the internal review and informing her of the findings of the review and any action proposed to be taken by the agency in relation to the matter.
The Privacy Commissioner has an oversight role in how agencies handle privacy complaints. Submissions may be made by the Privacy Commissioner to the agency in relation to your internal review. An agency is to consider any relevant material submitted by the Privacy Commissioner.
External review by NCAT
If you are not satisfied with the findings of the internal review or the actions taken (or proposed to be taken) by the agency in relation to your application, you may apply to the Administrative and Equal Opportunity Division of the NSW Civil and Administrative Tribunal (NCAT) for an external review.
The NSW Privacy Commissioner is independent, and does not represent applicants or agencies at NCAT.
What can NCAT review?
NCAT can only conduct an external review if a valid internal review application was previously made. If you have not made a valid internal review application to the relevant agency first, NCAT will have no power to consider your matter.
The review by NCAT is limited to the conduct (what you say the agency did or did not do with your personal information and/or health information) that you complained about in your original internal review application to the agency. NCAT cannot review conduct that occurred after your application for internal review was lodged, or any possible future conduct.
However, the scope of the review by NCAT can also include any clarification in correspondence between you and the agency, that took place during the internal review.
When to apply
You must lodge your application with NCAT within 28 days of receiving the report telling you about the outcome of your internal review from the agency.
If the internal review has not been completed within 60 days of you lodging your internal review application, then you can also lodge an application to the NCAT. Your application to the NCAT must be made within 28 days after the date when that 60 day period ends. In other words, within 88 days after you lodged your internal application with the agency.
NCAT may refuse a late application, so apply sooner rather than later.
What happens at NCAT
Generally, an initial case conference will be held with you (the applicant), the relevant agency you complained about and a Tribunal member to discuss the issues for review.
During the case conference the Tribunal member will assess whether there is any scope for resolution through further discussion or mediation. In some cases, a hearing may be required. The Tribunal member will explain the process further to you at that time.
Possible outcomes
At the end of the proceedings, NCAT will determine whether or not the conduct complained of breached one or more privacy principles. If it finds that the agency did breach one or more privacy principles, NCAT will then consider what, if any, remedies, may be appropriate.
If your complaint is proven, NCAT may order an agency to do certain things, such as make an apology, correct a record, change their practices, or pay compensation for harm suffered. However, it may also decide to take no further action, for example if the agency has already apologised or taken other steps to improve the situation.
Orders made by NCAT must be followed by the agency, and are enforceable.
Each party generally pays their own costs at NCAT, but in some cases costs may be awarded in your favour, or against you.
In certain circumstances parties can appeal a decision to NCAT’s Internal Appeal Panel. Such appeals can be made on a question of law. Some decisions can only be appealed directly to the Supreme Court or Court of Appeal. NCAT can advise you about this.
How to apply
The fee to lodge an application with the NCAT is $124 (as at November 2024).
NCAT can be contacted:
Telephone: 1300 006 228
Postal address: PO Box K1026, Haymarket NSW 1240
Street address: Level 10, John Maddison Tower, 86-90 Goulburn Street, Sydney (open 9am – 4:30pm)
Website: http://www.ncat.nsw.gov.au/
What else you should do
When you lodge an application with the NCAT, you should also provide (serve) a copy of your application, and any accompanying documents, to the agency you are complaining about.
Need help?
NCAT can help you with their procedures, but if you need legal advice, there are a wide range of services in NSW that can help you with free or low cost legal information, advice or assistance.
Community Legal Centres NSW
Provide information, advice and referrals on legal matters, and representation in targeted areas of law. Visit the website to search for your nearest centre: www.clcnsw.org.au
Community Justice Centres
Provide free mediation services to help people reach an agreement on a wide range of disputes. They can be contacted by telephone: 1800 990 777
LawAccess NSW
Provide legal information, referrals and in some cases, advice for people who have a legal problem in NSW. Telephone: 1300 888 529
TTY: 1300 889 529 TIS: 131 450
For more information
Contact the Information and Privacy Commission NSW (IPC):
Freecall: 1800 472 679
Email: ipcinfo@ipc.nsw.gov.au
Website: www.ipc.nsw.gov.au
NOTE: The information in this fact sheet is to be used as a guide only.
Legal advice should be sought in relation to individual circumstances.
