A privacy complaint is a concern raised about departmental processes, staff or services associated with the collection, handling or sharing of personal or health information.
A privacy complaint can only be made by the individual whose privacy has been breached or someone acting on their behalf. If acting on someone’s behalf, you may be asked to provide documentation to that effect.
Ways to make a complaint
Complete our online form
The form will be received by the privacy team who will prepare a response.
Other ways to make a complaint
However, if an individual is unsatisfied with the department’s response, they can escalate their complaint to OVIC or HCC.
What to include in a complaint
When making a complaint, we need to know the following:
- who you are and your contact details
- the name of the person whose privacy has been breached
- if acting on someone else’s behalf, your relationship to this person
- the school or area of the department have you been interacting with
- what happened and how you become aware of this
- where it happened
- when it happened
- who was involved (names and roles)
- what effect this has had on you or the person you are making the complaint on behalf of
- what outcome you would like to see from this complaint.
Time limits for complaints
The department must acknowledge the receipt of any complaints within three working days.
We will respond to privacy complaints within 20 working days. If circumstances require a longer period to investigate a complaint, we will discuss this with the complainant.
Reasons for an extended period of investigation might include:
- temporary absence of people within the department or service relevant to the complaint
- temporary absence of people outside of the department or service relevant to the complaint (for example: witnesses not employed by the department)
- complex nature of a complaint requiring extensive consultation or inquiry.
Investigating a complaint
Privacy complaints are investigated by the department’s privacy officers, who are experienced in understanding and applying the Victorian Information Privacy Principles and the Victorian Health Privacy Principles.
The privacy officer’s role in the complaints handling process is to investigate and resolve complaints appropriately. In responding to a complaint, the privacy officer will ensure that all relevant information is received from the complainant to help them in their investigation, and may contact the complainant to clarify any details.
To fulfil this role, the privacy officer will:
- be a contact point for general advice for any person considering and/or making a complaint about information privacy
- receive any complaint made orally or in writing
- document any complaint made orally
- if a complaint is on behalf of someone else, seek and obtain authorisation from that person in writing
- assist the complainant, if necessary, to clarify their complaint
- impartially investigate and assess the complaint, gathering any information they need to do so
- consider and develop options for resolution. This step may include engaging with the business area or school involved, other areas within the department, and/or the complainant
- prepare a proposed response to the complaint
- advise the complainant if it is unlikely the complaint is capable of resolution within 20 working days.
Departmental response to a complaint
The department will provide the complainant with a written response to a complaint, including a full response to the details of the complaint and the reasons for its response.
The director, knowledge, privacy and records, will review all complaint responses.
Record keeping of privacy complaints
The department retains the details of privacy complaints in a secure location where access is restricted to the privacy team.
Privacy complaints are also logged in a register, in the same secure location, which allows the department to map the number and types of complaints made, the outcome of those complaints, and to identify any improvements to processes or practices that may come out of a privacy complaint.
The privacy team updates the director, knowledge privacy and records on privacy complaints through weekly and monthly reporting.
The privacy team can be contacted by phone or email during business hours:
The Office of the Victorian Information Commissioner can be contacted via:
The Office of the Victorian Health Complaints Commissioner can be contacted via:
Reviewed 20 December 2022