Privacy Awareness Week: top five tips for privacy complaints management

Growing awareness of privacy and personal information rights over recent decades has led to an increase in privacy complaints, both to organisations and to Australia’s privacy regulator, the Office of the Australian Information Commissioner (OAIC).

This year’s Privacy Awareness Week theme – “Trust is built here. In every privacy complaint. In every resolution” – invites us to reflect on the importance of organisations’ management of privacy complaints.

The fundamentals of effective privacy complaints management are well‑established: organisations should treat every complaint seriously, conduct careful investigations, provide fulsome responses, remedy any compliance deficiencies, and improve transparency or internal practices to reduce the risk of similar complaints arising in the future. In addition to meeting legal obligations and reducing the risk regulatory consequences, the effective handling of complaints can enhance business by reshaping a negative experience into an opportunity for loyalty and further engagement, improving operational processes, and protecting brand and reputation.

Beyond the basics, these are our top five tips:

1. (Internal communications) Ensure that all internal communications relating to a complaint are courteous and privacy‑compliant. Complainants are often well aware of their personal information rights and may seek access to their personal information following an organisation’s response. Even where the underlying complaint has been resolved, discourteous internal commentary or the unnecessary collection of personal information (including from public sources) may give rise to a further, and potentially more serious, privacy complaint and associated compliance risks.
2. (Public‑facing privacy documentation) Privacy policies, collection notices and other public‑facing documents (including privacy clauses in terms and conditions) are often closely scrutinised by complainants. In our experience, unclear or outdated statements may be drawn into a complaint even where they are unrelated to its original subject matter. Make it a priority to review and update them as necessary, on a regular basis.
3. (Personal information disclosure in responses) Take care when disclosing personal information as part of a response to a complaint. The complainant’s own personal information should only be included in a response if the organisation has taken reasonable steps to verify their identity. Third party personal information should generally not be included unless there is a valid basis for disclosure under the Privacy Act 1988 (Cth).
4. (Focus on resolution options) Offering the individual a reasonable resolution to their complaint will reduce the risk that the OAIC will investigate if the complaint is escalated to it. The OAIC has recently announced several principles it will take into account when deciding whether to investigate an unresolved privacy complaint, including whether the issue is sufficiently serious to warrant the investment of OAIC resources, and whether the organisation has offered a reasonable resolution. OAIC orders in privacy determinations may serve as a useful guide as to whether a proposed resolution would be considered reasonable.
5. (Statutory tort of privacy) Consider exposure under the statutory tort of privacy. Even where the OAIC declines to investigate an individual’s complaint, the statutory tort of privacy may provide an alternative avenue for redress. When assessing a complaint, it may be prudent to consider whether the alleged conduct could satisfy the elements of the tort and the likelihood of the complainant bringing a claim. 

Privacy Awareness Week is an opportune time for organisations to reflect on their privacy culture and to reinforce their workforce’s awareness of key privacy obligations, policies and procedures. Please contact one of our experts if your organisation would like to explore these issues further.