Skip to Content

Home > Privacy and Personal Information

Part F: Privacy Complaints

Students and staff of SCU may lodge an informal complaint by contacting the unit concerned. If a privacy complaint cannot be resolved informally by the unit concerned, a person may apply for an 'internal review' of conduct they believe breaches an IPP and/or an HPP.

Internal review is the process by which SCU manages formal, written privacy complaints about how we have dealt with personal information or health information. All written complaints about privacy are considered to be an application for internal review, even if the applicant doesn't use the words 'internal review'.

By law, an application for internal review must:

  • be in writing
  • be addressed to SCU
  • specify an address in Australia to which the applicant is to be notified after the completion of the review, and
  • be lodged at SCU within six months from the time the applicant first became aware of the conduct that they want reviewed.

SCU encourages the use of the Internal Review Application Form, found at Appendix B to this Privacy Management Plan.

An application for internal review can be on behalf of someone else.

Where the applicant is not literate in either English or their first language and where there is no other organisation making the application on their behalf, staff should help the person to write their application. Staff should use a professional interpreter, if necessary. Applications in other languages will be accepted and translated, and all acknowledgments and correspondence to the applicant will be translated.

Students and staff of SCU may make a request for internal review and investigation through contact with SCU's Privacy Contact Officer.

Applications for internal review, or any written complaint about privacy, received at any SCU office, should be forwarded immediately to the SCU's Privacy Contact Officer who can be reached on (02) 6620 3465 or via email at privacy@scu.edu.au

If the Privacy Contact Officer decides that the complaint is about an alleged breach of the IPPs and/or HPPs, the internal review will be conducted by the Privacy Contact Officer or another staff member who:

  • was not involved in the conduct which is the subject of the complaint, and
  • is an employee or an officer of the agency, and
  • is qualified to deal with the subject matter of the complaint.

Extensions of time for lodgement

While the Act allows applicants six months to apply for an internal review from the time the applicant first becomes aware of the conduct, SCU may accept late applications.

Possible acceptable reasons for delay may be:

  • ill-health or other reasons relating to capacity
  • the complainant only recently becoming aware of his or her right to seek an internal review, or
  • the complainant reasonably believing that he or she would suffer ill-effects as a result of making an application at an earlier time.

However late applications that, because of their age, cannot be investigated in a meaningful way will be declined. In these cases, witnesses may no longer be available, documents may have been destroyed and memories may have faded.

Final decisions on the acceptance of late applicants will only be made by the SCU Privacy Contact Officer. Where the decision is made not to accept an application because it is too old, the reason will be explained in a letter to the applicant.

The Internal Review process

When SCU receives an internal review application the Privacy Contact Officer will:

  • send an acknowledgment letter to the applicant and advise that if the internal review is not completed within 60 days they have a right to seek a review of the conduct by the Administrative Decisions Tribunal, and
  • send a letter to the NSW Privacy Commissioner with details of the application. A photocopy of the written complaint will also be provided to the Privacy Commissioner.

Internal reviews follow the process set out in the Privacy NSW Internal Review Checklist.

When the internal review is completed the SCU Privacy Contact Officer will notify the applicant in writing of:

  • the findings of the review
  • the reasons for the finding, described in terms of the IPPs and/or HPPs
  • any action we propose to take
  • the reasons for the proposed action (or no action), and
  • the applicant's entitlement to have the findings and the reasons for the findings reviewed by the Administrative Decisions Tribunal.

We will also send a copy of this letter to the Privacy Commissioner.

Statistical information about the number of internal reviews conducted must be maintained for SCU's Annual Report.

External Review by the Administrative Decisions Tribunal

People may apply to the Administrative Decisions Tribunal for an external review of the conduct which was the subject of their earlier internal review application. The Tribunal may make orders requiring SCU to:

  • refrain from conduct or action which breaches an IPP, HPP or Code
  • perform in compliance with an IPP, HPP or Code
  • correct information disclosed by SCU, or
  • take steps to remedy loss or damage.

The Tribunal may also make an order requiring SCU to pay damages of up to $40,000 if the applicant has suffered financial loss or psychological or physical harm as a result of the conduct.

Updated: 07 May 2013