AUSTRAC prefers that complaints about breaches of Privacy Principles be made or confirmed in writing, so it can be sure about the details of the complaint. Generally, AUSTRAC will only accept complaints from an individual who believes an act or practice of AUSTRAC has interfered with their privacy and may have breached a Privacy Principle.
On this page, the term 'Privacy Principles' is used to refer to the Information Privacy Principles in the Privacy Act 1988 and, when they commence in March 2014, the Australian Privacy Principles, which regulate AUSTRAC's personal information handling practices.
A complaint should identify whether it is about:
- the collection of personal information
- the use of personal information
- the disclosure of personal information
- the security or storage of personal information
- the accuracy of personal information
- a refusal to give the complainant access to or find out about their personal information
- a refusal to change or delete personal information.
AUSTRAC's Freedom of Information Contact Officer will normally deal with privacy complaints. Otherwise, the complaint will be dealt with by someone who was not involved in the conduct the complaint is about. AUSTRAC will attempt to confirm (as appropriate and necessary) with the person making the complaint:
- their understanding of the conduct relevant to the complaint
- their understanding of the Privacy Principles relevant to the conduct
- what they expect as an outcome.
AUSTRAC will inform the person making the complaint:
- whether AUSTRAC will conduct an investigation
- the name, title, and contact details of the investigating officer
- the estimated completion date for the investigation process.
AUSTRAC will normally look at the following questions:
- Did the alleged conduct occur?
- Why did AUSTRAC collect the information?
- Was the information stored by AUSTRAC in a 'record' (as defined in the Privacy Act 1988) or a generally available publication?
- Did AUSTRAC comply with the relevant Privacy Principles or the requirements of the Privacy Act 1988 when dealing with the information?
After AUSTRAC has completed its enquiries, we will contact the person who has made the complaint, usually in writing, to advise the outcome and invite a response to AUSTRAC's conclusions about the complaint.
If a response is received, AUSTRAC will assess it and advise if AUSTRAC has changed its view.
If the person making the complaint is unsatisfied with the outcome, AUSTRAC will advise further options including, if appropriate, review by the Privacy Commissioner within the Office of the Australian Information Commissioner.