Make a privacy complaint
Part of the Privacy and right to information topic.
You can make a privacy complaint if you believe a Queensland Government agency has handled your personal information in a way that’s inconsistent with the privacy principles under the Information Privacy Act 2009 (IP Act).
On this page
In short
You can use this service to make a privacy complaint to the Office of the Information Commissioner (OIC) after you have complained to the relevant Government agency.
See How to make a privacy complaint for the full application process.
You'll be taken to another website.
What you should know
Privacy principles apply only to Queensland Government agencies. They do not apply to private sector organisations, community sector organisations, or individuals.
Before making a formal privacy complaint to the Office of the Information Commissioner Queensland (OIC), you must first try to resolve the issue directly with the relevant government agency.
If the agency does not respond to your complaint within 45 business days after you complained, or you are not satisfied with their response, you can then escalate your complaint to the OIC.
If you have not yet made a complaint, or 45 business days after the date you complained has not passed without a response from the relevant Government agency, the OIC will refer you back to that agency.
Who can use this service
| You can use this service if: |
|---|
|
you believe a Queensland Government agency has handled your personal information in a way that breaches the privacy principles under the Information Privacy Act 2009 (IP Act)
Correct.you aryouyou are |
|
you have already complained to the government agency who handled your personal information (and you are not satisfied with their response or you have not received a response and 45 business days has elapsed); and
Correct.you aryouyou are |
|
the complaint relates to your own personal information unless you have authority to act on behalf of another person; and
Correct.you aryouyou are |
|
your complaint will be made within 12 months after becoming aware of the possible privacy breach.
Correct.you aryouyou are |
| Don't use this service if: |
|---|
Incorrect.your complaint is about a private sector organisation, community sector organisation, or individual. |
How to make a privacy complaint
Step 1: Contact the relevant agency
Before making a formal privacy complaint to the OIC, you must first try to resolve the issue directly with the relevant government agency.
- Write a complaint explaining the act or practice that you are concerned about.
- Keep a copy of your complaint for your records.
- Submit your complaint to the agency. The Right to Information and Information Privacy website has a list of privacy contacts for each agency. If the agency cannot be located on this website you will need to search for the relevant agency’s website.
The government agency has 45 business days to respond. If your complaint is resolved, the process ends here.
If the agency does not respond to your complaint or you are not satisfied with their response, you can escalate your complaint to the OIC:
- after 45 business days (for no response)
- immediately, if you are not satisfied with the agency’s response.
Step 2: Make a formal complaint to the OIC
Choose how to make a formal privacy complaint to the OIC and follow the steps.
Step 1: Complete the complaint form
Complete the online OIC privacy complaint form. You'll be taken to another website.
If you cannot access the online form
You can also lodge a complaint via email at privacy@oic.qld.gov.au.
If you cannot lodge a complaint online you can write to the OIC by post:
Attention: Privacy team
Office of the Information Commissioner
PO Box 10143
Adelaide Street
BRISBANE QLD 4000
Step 2: Provide details of the complaint
Include:
- details of the act or practice you are complaining about and when you became aware of them
- the date you first complained to the agency
- copies of any relevant documents including a copy of your complaint to the agency and the agency's response (if any)
- details of any harm suffered because of the possible privacy breach
- what resolution you are seeking.
Step 3: Confirmation of receipt
You should receive notice from the OIC within 5 days that your privacy complaint has been received. Find out what to expect when you lodge a privacy complaint with the OIC
Step 4: Complaint is assessed
The OIC will assess whether your complaint shows an 'arguable case' that a privacy breach has occurred. They will provide you with a written notice that sets out the reason for their decision.
Step 5: Your complaint is rejected or accepted
If the OIC does not accept your complaint, there are no more options available to continue your complaint under the IP Act.
If your complaint is accepted the OIC will work with you and the agency to resolve the complaint through mediation.
Step 6: Referral of unresolved complaint
If it is unlikely that your complaint will be resolved by mediation, you can ask for it to be referred to the Queensland Civil and Administrative Tribunal (QCAT).
If the complaint is referred, you and the agency will be the parties to the hearing before QCAT.
How long it takes
Receiving confirmation that your formal complaint has been lodged with the OIC: 5 days.
Resolving your complaint directly with the agency:
- up to 45 days
- longer if you agree to an extension of the 45-business day timeframe.
The timeframe to resolve your formal complaint with the OIC varies depending on:
- the complexity of the complaint
- the caseload of the OIC and QCAT.
How much it costs
There is no cost for this service.
Managed by: Department of Justice