The OAIC and making a privacy complaint

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which body oversees the Privacy Act 1988 and handles privacy complaints in Australia?

A The OAIC

B The Australian Tax Office

2. You think an app has misused your personal data. What should you usually do FIRST?

A Complain to the organisation

B Go straight to the OAIC

3. When can you escalate a privacy complaint to the OAIC?

A When the organisation's reply is unsatisfactory or it does not reply in time

B Only after taking the organisation to court

4. Which statement about the OAIC is true?

A It only talks to individuals and never to organisations

B It publishes guidance to help organisations follow the APPs

5. Which is a job of the OAIC?

A Writing the privacy policy for a company

B Investigating a complaint about an APP breach

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1OAIC		AThis is wrong. The OAIC can investigate, make determinations and take action, including seeking civil penalties for serious or repeated breaches of the APPs.
2OAIC guidance		BAdvice and guidelines that help organisations understand and follow the Australian Privacy Principles
3Step one of a privacy complaint: contact the organisation that handled your data and give it a chance to fix the problem		Coaic.gov.au/privacy/privacy-complaints
4If the organisation does not resolve your complaint (usually within 30 days), you can escalate it to the OAIC		DEmail: privacy@shopname.com.au
5Complain to the OAIC first, before telling the organisation		EThe government body that oversees the Privacy Act, gives guidance and handles privacy complaints
6The OAIC only gives advice and can never penalise anyone		FThe OAIC usually expects you to complain to the organisation first and give it time to respond (about 30 days). Only then can you escalate to the OAIC.

Definitions

OAIC

Fill in the Blanks

Complete each line of code by filling in the missing parts.

regulator = ____

sendComplaint(____________) waitForReply(30)

__ reply = "none" THEN escalate(OAIC) END IF

OAIC.publish(________) organisations.follow(guidance)

OAIC.apply(_______, organisation)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A complain to the organisation

B wait 30 days for a reply

C if no reply or unhappy then

D complain to the police

Question 2

A body ← ASIC

B oversees ← Privacy Act 1988

C output body + oversees

Question 3

A if APP breach is serious then

B OAIC can never penalise

C penalty can be millions

D end if

Question 4

A need ← help with APPs

B a business reads guidance

C read guidance from the ATO

Question 5

A problem ← data was misused

B contact the OAIC first

C keep a copy of the complaint

Answer Key

The OAIC and making a privacy complaint

Section A: Quick Questions

A — The OAIC

A — Complain to the organisation

A — When the organisation's reply is unsatisfactory or it does not reply in time

B — It publishes guidance to help organisations follow the APPs

B — Investigating a complaint about an APP breach

Section B: Match the Pairs

OAIC → The government body that oversees the Privacy Act, gives guidance and handles privacy complaints

OAIC guidance → Advice and guidelines that help organisations understand and follow the Australian Privacy Principles

Step one of a privacy complaint: contact the organisation that handled your data and give it a chance to fix the problem → Email: privacy@shopname.com.au

If the organisation does not resolve your complaint (usually within 30 days), you can escalate it to the OAIC → oaic.gov.au/privacy/privacy-complaints

Complain to the OAIC first, before telling the organisation → The OAIC usually expects you to complain to the organisation first and give it time to respond (about 30 days). Only then can you escalate to the OAIC.

The OAIC only gives advice and can never penalise anyone → This is wrong. The OAIC can investigate, make determinations and take action, including seeking civil penalties for serious or repeated breaches of the APPs.

Section C: Definitions

OAIC — The Office of the Australian Information Commissioner: the government body that oversees the Privacy Act, gives guidance, handles privacy complaints and can act on APP breaches.

Section D: Fill in the Blanks

regulator = OAIC

sendComplaint(organisation)
waitForReply(30)

IF reply = "none" THEN
  escalate(OAIC)
END IF

OAIC.publish(guidance)
organisations.follow(guidance)

OAIC.apply(penalty, organisation)

Section E: Spot the Error

D — If the organisation does not reply or you are unhappy with its answer, you escalate the privacy complaint to the OAIC, not the police.

A — The OAIC oversees the Privacy Act 1988. ASIC regulates companies and financial services, so line 1 should be body ← OAIC.

B — The OAIC can seek civil penalties for serious or repeated breaches of the APPs. It is wrong to say it can never penalise.

C — The OAIC publishes guidance to help organisations follow the APPs. The ATO is the tax office, so line 3 should say the OAIC.

B — You should complain to the organisation first and give it a chance to fix the problem. The OAIC is the next step if that fails.