Why does an IPP entity need an effective complaints process?
An effective complaint handling process can increase the likelihood of resolving the complaint before it escalates, increase public trust and identify opportunities for service improvement.
When the OIC receives a complaint, the complainant is required to provide a copy of the complaint they made to the IPP entity and any response received. The OIC may decline to deal with a complaint where the IPP entity has not had sufficient time to deal with the complaint or is dealing adequately with the complaint.
What is the best way for an IPP entity to receive a privacy complaint?
An effective complaint handling system should include a visible, accessible and user-friendly channel for individuals to make a complaint about an interference with privacy.
The PRIS Act does not prescribe what method an IPP entity should use to receive privacy complaints. The IPP entity should consider the needs of their customers or members of the public, including how they usually engage with them. For example, complaints may be received using an online complaints form or a dedicated complaints or privacy email address.
An IPP entity should ensure their website and privacy policy include prominent information about how to make a privacy complaint.
An IPP entity may use their existing complaints process to receive privacy complaints. However, it is important that the IPP entity’s privacy officer (or their team) is involved in the management of privacy complaints.
What should an IPP entity do when it receives a privacy complaint?
The IPP entity should take steps to address privacy complaints objectively, fairly and confidentially.
Below is a high level outline of the steps the OIC would expect an IPP entity to have taken when handling a privacy complaint.
STEP 1 – Acknowledge the complaint
- Tell the complainant you have received their complaint as soon as practicable.
- Tell the complainant when they can expect to receive a response to their complaint. Wherever possible this should be consistent with the expected timeframe for an IPP entity to respond to a privacy complaint. For further information please see What is the timeframe for an IPP entity to respond to a privacy complaint?
- Tell the complainant who they can contact within your entity about their complaint.
STEP 2 – Identify the main concerns and possible resolutions
- Identify the complainant’s main concern(s) and any harm they may have suffered as a result. A conversation with the complainant may help you to understand and address their concern(s).
- Within your entity, make inquiries or investigate the issues raised.
- Proactively work with the complainant to resolve their complaint. This includes managing the complainant’s expectations by telling them whether the outcome(s) they seek are achievable.
STEP 3 – Respond
- Implement the complaint resolution. This might include offering the complainant an apology and/or an explanation of what happened.
- Respond to the complaint in writing and set out what you have done to resolve the complaint. This might include how you investigated the complaint and the steps you have taken to resolve it. Your response should include information about how the complainant can make a complaint to the OIC if they are unsatisfied with the outcome.
- If your investigation of the complaint identified problems with how your entity handles personal information, consider the steps you can take to reduce the risk of similar incidents occurring in the future.
Remember, recipients of public services often have limited alternative service options and it is likely the complainant will have to continue dealing with your entity. The way you respond to their privacy complaint is an opportunity to increase trust.
Further resources
IPP entities should always follow principles of effective complaint handling. The Ombudsman WA provides Effective Complaint Handling Guidelines.
Print this page
