The Office of the Australian Information Commissioner ('OAIC') is an independent federal agency that protects privacy rights and regulates privacy practices of large companies and government entities. It also ensures public access to documents through the freedom of information process and upholds consumer data rights. If you have concerns about your privacy or access to information, you can make a complaint to the OAIC.
What types of complaints can you make?
Complaints can be made relating to government agencies and some private sector organisations. The OAIC focuses on complaints surrounding:
- Privacy: Handling of personal information by an Australian government agency or private sector organisation with an annual turnover of more than $3 million.
- Freedom of information handling: Issues with how an agency has handled a Freedom of Information ('FOI') request.
- Freedom of information review: Problems with an agency’s response time or handling of an FOI request.
- Consumer Data Right: Mishandling of consumer data by a business, specifically for small businesses with an annual turnover of $3 million or less.
- Data Breaches: Reporting of eligible data breaches under the Notifiable Data Breach scheme.
- Agency freedom of information extension of time request: Agencies applying for an extension to respond to an FOI request.
Jurisdiction:
The OAIC can investigate complaints across Australia, excluding state-based organisations, but including Australian Capital Territory agencies.
Time Limitations:
- Complaints generally must concern events within the last 12 months.
- Privacy and Consumer Data Right complaints require a 30-day response window from the organisation before escalating.
- FOI review requests must be lodged within 30 or 60 days, depending on the decision.
The OAIC will not deal with complaints about:
- Privacy Act 1988 applies only to government agencies and private businesses with a turnover over $3 million.
- FOI laws apply only to government agencies.
- Consumer Data Right regulations apply to specific industries.
Exercise of discretion:
The OAIC may not proceed with a complaint if certain conditions, like improper motivations, insufficient information, or better-suited external resolution schemes, are met.
Who can you make a complaint against?
You can make a complaint against:
- Individuals: Generally not the subject of complaints, except in rare FOI-related cases.
- Australian Government agencies and departments: All Australian government agencies and departments, except some like ASIO.
- Private businesses with an annual turnover of more than $3 million: Complaints about privacy breaches are applicable.
- Private businesses with an annual turnover of less than $3 million: Complaints can be made regarding Consumer Data Right regulations.
Additional information:
Contact OAIC at 1300 363 992 for jurisdiction clarification.
Are you eligible to make a complaint?
Who can make a complaint?
Anyone can lodge a complaint.
Have you complained to the relevant body before contacting the Office?
Must complain to the relevant organisation first and wait 30 days before escalating to OAIC.
Can complaints be made on behalf of someone?
Yes, with written consent and proper authority.
The OAIC will not deal with complaints about:
Complaints generally must be about incidents within 12 months.
Additional information:
Services are free, and legal representation is optional but self-funded.
What can this body do to help?
This body may provide:
- Taking steps to address the matter: Correcting records or providing access to documents.
- Apology: The organisation can issue an apology.
- Change in practices or procedures: The organisation may be required to change how they manage information.
- Training staff: The organisation may need to undergo further training.
- Compensation for financial or non-financial loss: Conciliation may lead to financial settlements.
- Other non-financial options: Non-monetary compensations like service subscriptions.
- No result: If requirements are met, the complaint may be closed.
- Civil Penalty: Courts can impose fines for severe breaches.
How to prepare your complaint
Format:
Complaints must be written using OAIC’s online forms.
Personal Details:
Include your name and contact details; anonymity is not allowed.
Respondent’s Details:
Provide information about the body you’re complaining against.
Relevant Facts:
Detailed facts about the complaint are required.
What NOT to include:
Do not include false or misleading statements.
Additional information:
Detailed advice and support are available on the OAIC website.
Lodging your complaint and next steps:
Where to lodge your complaint:
- For privacy complaints: here
- For freedom of information review requests: here
- For Consumer Data Right complaints: here
Receipt:
The online form guides you through submission and provides expected timeframes.
Assessment/Investigation:
The OAIC assesses the complaint for jurisdiction and necessity for more information.
Conciliation:
A meeting process facilitated by the OAIC to find a mutually satisfactory resolution.
Additional information:
Keep a copy of your complaint and all communication with the agency or organisation.
For more information and to lodge a complaint, visit the Office of the Australian Information Commissioner.
More information:
Refer to the factsheet provided below for more information.
