Find out how to make a privacy complaint about the handling of your own personal information, or the personal information of a child for which you have parental or carer’s rights.
A privacy complaint is a concern raised about Departmental processes, staff or services associated with the collection, handling or sharing of personal or health information.
Making a complaint
Complaints can be made to a regional office, or directly to the Department’s privacy team. Regional offices will refer any privacy complaints to the privacy team for response.
Complaints can be made verbally or in writing.
If a complaint is made to the Office of the Victorian Information Commissioner (OVIC) or the Office of the Victorian Health Complaints Commissioner (HCC), these Offices will confirm first that the Department has had the opportunity to respond directly.
However if an individual is unsatisfied with the Department’s response, they can escalate their complaint to OVIC or HCC.
What to include in a complaint
When making a complaint, we need to know the following:
- who you are and your contact details
- the person whose privacy has been breached (in the case of parents or carers of children)
- the nature of your complaint
- how you believe your (or your child’s) privacy has been breached:
- what happened
- where did it happen
- when did it happen
- who did it
- what effect this has had on you
- what outcome you would like to see from this complaint.
Time limits for complaints
The Department must acknowledge the receipt of any complaints within three working days.
We will respond to privacy complaints within 20 working days. If circumstances require a longer period to investigate a complaint, we will discuss this with the complainant.
Reasons for an extended period of investigation might include:
- temporary absence of people within the Department or service relevant to the complaint
- temporary absence of people outside of the Department or service relevant to the complaint (e.g. witnesses not employed by the Department)
- complex nature of a complaint requiring extensive consultation or inquiry.
Investigating a complaint
Privacy complaints are investigated by the Department’s privacy officers, who are experienced in understanding and applying the Victorian Information Privacy Principles and the Victorian Health Privacy Principles.
The privacy officer’s role in the complaints handling process is to investigate and resolve complaints appropriately. In responding to a complaint, the privacy officer will ensure that all relevant information is received from the complainant to help them in their investigation, and may contact the complainant to clarify any details.
To fulfil this role, the privacy officer will:
- be a contact point for general advice for any person considering and/or making a complaint about information privacy
- receive any complaint made orally or in writing
- document any complaint made orally
- if a complaint is on behalf of someone else, seek and obtain authorisation from that person in writing
- assist the complainant, if necessary, to clarify their complaint
- impartially investigate and assess the complaint, gathering any information they need to do so
- consider and develop options for resolution. This step may include engaging with the business area or school involved, other areas within the Department, and/or the complainant
- prepare a proposed response to the complaint
- advise the complainant if it is unlikely the complaint is capable of resolution within 20 working days.
Departmental response to a complaint
The Department will provide the complainant with a written response to a complaint, including a full response to the details of the complaint and the reasons for its response.
The communication will also advise the complainant of the right to appeal to the Office of the Victorian Privacy Commissioner or Health Services Commissioner if the complainant remains dissatisfied.
The director, knowledge, privacy and records, will review all complaint responses.
Record keeping of privacy complaints
The Department retains the details of privacy complaints in a secure location where access is restricted to the privacy team.
Privacy complaints are also logged in a register, in the same secure location, which allows the Department to map the number and types of complaints made, the outcome of those complaints, and to identify any improvements to processes or practices that may come out of a privacy complaint.
The privacy team updates the director, knowledge privacy and records on privacy complaints through weekly and monthly reporting.
The privacy team can be contacted by phone or email during business hours:
The Office of the Victorian Information Commissioner can be contacted via:
The Office of the Victorian Health Complaints Commissioner can be contacted via: