Decision Guide: Investigations and Dispute Resolution

Accessibility focused approach • Don’t assume either the complainant or the respondent will have knowledge of our process. • Don’t try and interpret facts in order to fit a Privacy Act complaint. [...] • Significant discussions with a party over the telephone may need to be followed up in writing. [...] People and bodies outside our jurisdiction We don’t have jurisdiction to investigate the complaint if it concerns a person or body that is not an “agency” within the terms of section 8 of the Privacy Act. [...] When we do have jurisdiction to investigate a complaint, check if the complaint “more properly” belongs with the Inspector-General of Intelligence and Security (“IGIS”). [...] • If it is an allegation of a failure to respond to an access request, has the complainant followed up with the respondent? [...] S74(1)(j) The complaint is frivolous, vexatious or not made in good faith • Consider the conduct of both parties. • Is the complainant genuinely seeking to address a privacy concern? [...] • Has the agency or another regulator already investigated the matter and produced findings? If there is a dispute of facts, or the agency does not consider its actions a breach, it is likely that an investigation would be useful before an attempt to settle. [...] • Further, if you identify that the complaint (or part of it) may relate to a different respondent (or you believe now that it is appropriate to notify an individual employee, member or agent), you must notify that agency or individual in accordance with section 80. [...] Office of the Privacy Commissioner Decision Guide: Investigations & Dispute Resolution 28 Timeliness • We are required to conduct the investigation in a timely manner (section 81). [...] • If we decide to discontinue an investigation, we must notify the parties of this and provide reasons (section 81(4)).