Part 5Review of certain conduct
52Application of Part
(1)
This Part applies to the following
conduct—
(a)
the contravention by a public sector agency of an
information protection principle that applies to the
agency,
(b)
the contravention by a public sector agency of a
privacy code of practice that applies to the agency,
(c)
the disclosure by a public sector agency of
personal information kept in a public register.
(2)
A reference in this Part to conduct includes a
reference to alleged conduct.
(3)
This Part does not apply to any conduct that
occurred before the commencement of this Part.
(4)
Section 53 (Internal reviews) of the Administrative Decisions Review Act
1997 does not apply to or in respect of conduct to which
this Part applies.
s 52: Am 2013 No 95,
Sch 2.118 [1].
53Internal review by public sector
agencies
(1)
A person (the applicant) who is
aggrieved by the conduct of a public sector agency is entitled to a review of
that conduct.
(1A)
There is no entitlement under this section to the
review of the conduct of a Minister (or a Minister’s personal staff) in
respect of a contravention of section 15 (Alteration of personal
information).
Note—
Any such conduct can still be administratively
reviewed by the Tribunal. See section 55 (1A).
(2)
The review is to be undertaken by the public
sector agency concerned.
(3)
An application for such a review
must—
(a)
be in writing, and
(b)
be addressed to the public sector agency
concerned, and
(c)
specify an address in Australia to which a notice
under subsection (8) may be sent, and
(d)
be lodged at an office of the public sector
agency within 6 months (or such later date as the agency may allow) from the
time the applicant first became aware of the conduct the subject of the
application, and
(e)
comply with such other requirements as may be
prescribed by the regulations.
(4)
Except as provided by section 54 (3), the
application must be dealt with by an individual within the public sector
agency who is directed by the agency to deal with the application. That
individual must be, as far as is practicable, a person—
(a)
who was not substantially involved in any matter
relating to the conduct the subject of the application,
and
(b)
who is an employee or officer of the agency,
and
(c)
who is otherwise suitably qualified to deal with
the matters raised by the application.
(5)
In reviewing the conduct the subject of the
application, the individual dealing with the application must consider any
relevant material submitted by—
(a)
the applicant, and
(b)
the Privacy
Commissioner.
(6)
The review must be completed as soon as is
reasonably practicable in the circumstances. However, if the review is not
completed within 60 days from the day on which the application was received,
the applicant is entitled to make an application under section 55 to the
Tribunal for an administrative review of the conduct
concerned.
(7)
Following the completion of the review, the
public sector agency whose conduct was the subject of the application may do
any one or more of the following—
(a)
take no further action on the
matter,
(b)
make a formal apology to the
applicant,
(c)
take such remedial action as it thinks
appropriate (eg the payment of monetary compensation to the
applicant),
(d)
provide undertakings that the conduct will not
occur again,
(e)
implement administrative measures to ensure that
the conduct will not occur again.
(7A)
A public sector agency may not pay monetary
compensation under subsection (7) if—
(a)
the applicant is a convicted inmate or former
convicted inmate or a spouse, partner (whether of the same or the opposite
sex), relative, friend or an associate of a convicted inmate or former
convicted inmate, and
(b)
the application relates to conduct of a public
sector agency in relation to the convicted inmate or former convicted inmate,
and
(c)
the conduct occurred while the convicted inmate
or former convicted inmate was a convicted inmate, or relates to any period
during which the convicted inmate or former convicted inmate was a convicted
inmate.
(8)
As soon as practicable (or in any event within 14
days) after the completion of the review, the public sector agency must notify
the applicant in writing of—
(a)
the findings of the review (and the reasons for
those findings), and
(b)
the action proposed to be taken by the agency
(and the reasons for taking that action), and
(c)
the right of the person to have those findings,
and the agency’s proposed action, administratively reviewed by the
Tribunal.
s 53: Am 1999 No 31,
Sch 1.34 [1]; 2002 No 116, Sch 1 [2]; 2008 No 23, Sch 3.35; 2010 No 71, Sch 1
[7]; 2013 No 95, Sch 2.118 [3]–[5].
54Role of Privacy Commissioner in internal review
process
(1)
A public sector agency that receives an
application under section 53 must—
(a)
as soon as practicable after receiving the
application notify the Privacy Commissioner of the application,
and
(b)
keep the Privacy Commissioner informed of the
progress of the internal review, and
(c)
inform the Privacy Commissioner of the findings
of the review and of the action proposed to be taken by the agency in relation
to the matter.
(2)
The Privacy Commissioner is entitled to make
submissions to the agency in relation to the subject matter of the
application.
(3)
The Privacy Commissioner may, at the request of
the agency concerned—
(a)
undertake the internal review on behalf of the
agency, and
(b)
make a report to the agency in relation to the
application.
(4)
The Privacy Commissioner is entitled to charge an
appropriate fee for that service.
(5)
Section 53 (7), (7A) and (8) apply in respect of
an internal review that is undertaken by the Privacy Commissioner on behalf of
an agency.
s 54: Am 2002 No 116,
Sch 1 [3].
55Administrative review of conduct by
Tribunal
(1)
If a person who has made an application for
internal review under section 53 is not satisfied with—
(a)
the findings of the review,
or
(b)
the action taken by the public sector agency in
relation to the application,
the person may apply to the Civil and Administrative
Tribunal for an administrative review under the Administrative
Decisions Review Act 1997 of the conduct that was the
subject of the application under section 53.
(1A)
A person (the applicant) who is
aggrieved by the conduct of a Minister (or a Minister’s personal staff)
constituting a contravention of section 15 (Alteration of personal
information) may apply to the Civil and Administrative Tribunal for an
administrative review under the Administrative Decisions
Review Act 1997 of the conduct.
(2)
On reviewing the conduct of the public sector
agency concerned, the Tribunal may decide not to take any action on the
matter, or it may make any one or more of the following orders—
(a)
subject to subsections (4) and (4A), an order
requiring the public sector agency to pay to the applicant damages not
exceeding $40,000 by way of compensation for any loss or damage suffered
because of the conduct,
(b)
an order requiring the public sector agency to
refrain from any conduct or action in contravention of an information
protection principle or a privacy code of practice,
(c)
an order requiring the performance of an
information protection principle or a privacy code of
practice,
(d)
an order requiring personal information that has
been disclosed to be corrected by the public sector
agency,
(e)
an order requiring the public sector agency to
take specified steps to remedy any loss or damage suffered by the
applicant,
(f)
an order requiring the public sector agency not
to disclose personal information contained in a public
register,
(g)
such ancillary orders as the Tribunal thinks
appropriate.
(3)
Nothing in this section limits any other powers
that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act
1997.
(4)
The Tribunal may make an order under subsection
(2) (a) only if—
(a)
the application relates to conduct that occurs
after the end of the 12 month period following the date on which Division 1 of
Part 2 commences, and
(b)
the Tribunal is satisfied that the applicant has
suffered financial loss, or psychological or physical harm, because of the
conduct of the public sector agency.
(4A)
The Tribunal may not make an order under
subsection (2) (a) if—
(a)
the applicant is a convicted inmate or former
convicted inmate or a spouse, partner (whether of the same or the opposite
sex), relative, friend or an associate of a convicted inmate or former
convicted inmate, and
(b)
the application relates to conduct of a public
sector agency in relation to the convicted inmate or former convicted inmate,
and
(c)
the conduct occurred while the convicted inmate
or former convicted inmate was a convicted inmate, or relates to any period
during which the convicted inmate or former convicted inmate was a convicted
inmate.
(5)
If, in the course of an administrative review,
the Tribunal is of the opinion that the chief executive officer or an employee
of the public sector agency concerned has failed to exercise in good faith a
function conferred or imposed on the officer or employee by or under this Act
(including by or under a privacy code of practice), the Tribunal may take such
measures as it considers appropriate to bring the matter to the attention of
the responsible Minister (if any) for the public sector
agency.
(6)
The Privacy Commissioner is to be notified by the
Tribunal of any application for an administrative review. The Privacy
Commissioner has a right to appear and be heard in any proceedings before the
Tribunal in relation to an administrative review.
(7)
The Information Commissioner is to be notified by
the Tribunal of any application for a review under this section that concerns
the provision of government information by an agency (within the meaning of
the Government Information (Public Access) Act
2009). The Information Commissioner has a right to appear
and be heard in any proceedings before the Tribunal in relation to such a
review.
s 55: Am 2002 No 116,
Sch 1 [4] [5]; 2003 No 40, Sch 2.24 [2]; 2008 No 23, Sch 3.35; 2010 No 71, Sch
1 [8] [9]; 2013 No 95, Sch 2.118 [6]–[8].
56
s 56: Rep 2013 No 95,
Sch 2.118 [9].