Privacy in complaint management

People often complain to the Queensland Ombudsman that a State Government agency or local council has not done enough to respond to their concerns about a third party’s actions. For example:

• a parent may complain that a school has not done enough to respond to her complaints about her child being bullied by other students at the school
• a neighbour may complain that a local council has not done enough to respond to his complaints about the state of his neighbour’s property
• Housing Department tenants may complain that the department has not done enough to respond to their complaints about another tenant’s behaviour.

Investigation of such complaints often show that the council or agency has taken the complaint seriously, has properly investigated it, and taken appropriate action to address the issues with the person complained about.

Commonly, though, the agency or council has not told the complainant much, if anything, about what it has actually done, because it is worried about breaching the Information Privacy Act 2009 by improperly disclosing personal information about the third party.

Members of the community sometimes find it hard to accept assurances that “we take your concerns seriously, but privacy requirements prevent us from telling you what we are doing about them”. That kind of response is likely to provoke further complaints through the agencies’ complaints management system, and to this Office.

Agencies often do collect personal information when responding to complaints, including information about the person/s complained about, and possibly witnesses as well. Agencies have to ensure that they handle this personal information properly.

However, as the Office of the Queensland Information Commissioner recently-published Privacy in Complaints Management – Status and Outcomes guideline points out, the privacy principles permit an agency to disclose an individual’s personal information to a third party where this is ‘required or authorised under a law’ (IPP 11(1)(d) and NPP 2(1)(f)).

A relevant law in this context is section 219A of the Public Service Act 2008, which requires agencies to establish and implement a system for managing customer complaints that complies with the current Australian Standard about handling customer complaints, and to give notice of the outcome of a customer complaint to the complainant. The Australian Standard requires that the agency include ‘reasons’ with its outcome decision notice.

Similarly, section 306(3)(d) of the Local Government Regulation 2012 requires the local government to inform an affected person of the local government’s decision about a complaint, and the reasons for the decision.

Therefore, to the extent that an agency needs to include personal information in providing a reasoned notice of the outcome of a complaint falling within the scope of these provisions, then that disclosure of personal information will be authorised by law.

In practice, this means that an agency can and should explain to a complainant:

• which issues raised by the complainant it has investigated
• if it has not investigated all the issues raised by the complainant, why some issues were not investigated
• the steps that the agency actually took to investigate the complaint (for example a site inspection, interviewing witnesses, obtaining relevant documents)
• which issues were substantiated and which were not, including the evidence and reasons why any issues were unsubstantiated; and
• what action the agency has taken to address the substantiated issues, having due regard to privacy considerations.

The complainant does not necessarily need to know exactly what action the agency has taken with respect to the person the complaint is about – it is usually sufficient for the agency to refer to the range or kinds of actions that it is authorised to take in the circumstances, and confirm that it has taken some action within that range.

A response like this shows the complainant that the agency did take their complaint seriously, while still protecting the privacy of the person complained about.