The Personal Information Protection Act 2004 (Tas) gives people the right to complain to the Ombudsman if they think there has been a breach of a personal information protection principle (PIPP) by a personal information custodian.
Personal information custodians include Tasmanian public authorities like state government departments, local councils, statutory bodies, the University of Tasmania, Tasmania Police, state-owned companies and, in some circumstances, organisations providing services for the state.
What is personal information?
Personal information means any information or opinion about an individual whose identity is apparent or whose identity can be reasonably determined from the information or opinion. The information may be in any recorded format. For the information to be considered personal information, the person must be alive, or they should not have been dead for more than 25 years.
Examples of personal information include a person’s name, gender, date of birth, address, financial details, marital status, education and employment history.
Some personal information is classified as ‘sensitive information’. This is information about a person’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association or trade union, sexual preferences or practices, criminal record and health information.
Generally, an agency needs to obtain consent from a person to collect sensitive information.
Personal information custodians must generally comply with the PIPP.
Ten personal information protection principles
Complaints can only be made if a person thinks there has been a breach of one or more of the ten PIPP in the Act.
Managing personal information
Personal information custodians should:
- have a publicly available policy that tells people how it will handle personal information
- take reasonable steps to notify people of the organisation’s contact details, their rights to access their own personal information and the main consequences if the personal information is not provided
- generally not use personal information for a secondary purpose unrelated to the main purpose for which it was collected
- think before disclosing personal information and get consent from the individual if there is a reason for disclosing personal information that is different from the reason for which it was collected
- give people access to the personal information held about them if they ask
- keep personal information secure and safe from unauthorised access, misuse or disclosure
- not keep information that is no longer needed or that is no longer required to be retained
- take reasonable steps to keep personal information accurate and up to date
- consider making someone in the organisation responsible for its responsibilities under the Act and for promoting compliance with the Act.
Complaint process
What happens when the Ombudsman receives a complaint?
The Ombudsman will conduct a preliminary assessment of the complaint to decide whether to ‘deal with it’. This generally involves considering if the Ombudsman has jurisdiction and seeking further information from the person making the complaint or the custodian.
The Ombudsman may decide not to deal with a complaint if it is frivolous, vexatious, lacking in substance, trivial, or if the alleged breach is permitted under law.
What happens when the Ombudsman decides to investigate a complaint?
An Ombudsman Tasmania investigation officer will be assigned to handle the complaint.
As the first step in the process, the complaint will be outlined to the custodian and a response will be sought.
If the matter proceeds to an investigation, it is conducted in accordance with Division 3 of the Ombudsman Act 1978 (Tas). The investigation will generally examine evidence in the form of documents, but interviews or inspection of premises may be required.
What can be done to resolve a complaint?
If the Ombudsman believes that a personal information custodian has breached a PIPP, the Ombudsman must tell the person who made the complaint and the agency involved. The Ombudsman may also make recommendations about what should be done. The Ombudsman must provide a copy of the advice and any recommendation to the relevant minister for tabling in Parliament.
For further information please call us on 1800 001 170 to speak to an officer about your enquiry.