Document ID: chunk:federal_register_of_legislation:F2016L00360:reg:14:p11
Version: federal_register_of_legislation:F2016L00360
Segment Type: reg
Provision Reference: reg 14 (pt 11/16)
Character Range: 28811–31795

an act, or engage in a practice, in the future that interferes with the privacy of an individual.

  Giving an enforceable undertaking

9.2  The individual giving and executing the undertaking must have the authority to negotiate on behalf of, and bind, the respondent entity  or person.

Terms of an undertaking

9.3  For an undertaking to be acceptable to the Information Commissioner, it should include the terms listed at section 8.4 of these guidelines.

9.4  The Information Commissioner will not accept an enforceable undertaking under the Privacy Act that includes any of the terms listed at section 8.5 of these guidelines.

  General approach to acceptance of an undertaking

9.5  In deciding whether to accept an undertaking under the Privacy Act, the Information Commissioner may consider those matters referred to in section 8.6 of these guidelines.

  Withdrawing an undertaking accepted by the Information Commissioner

9.6  The person may withdraw or vary the undertaking at any time, but only with the written consent of the Information Commissioner.

9.7  The Information Commissioner may cancel the undertaking by written notice.

9.8  When considering whether to consent to the withdrawal or variation of an undertaking, the Information Commissioner may consider those matters referred to in section 8.9 of these guidelines.

General approach to enforcing undertakings

9.9  Under section 33F of the Privacy Act, if the Information Commissioner considers that the entity has breached an undertaking they have given under section 33E, and that undertaking has not been withdrawn or cancelled, the Information Commissioner may apply to the Federal Court or the Federal Circuit Court for one or more of the orders listed in that section:
           a)      an order directing the entity to comply with the undertaking;
           b)     any order that the court considers appropriate directing the entity to compensate any other person who has suffered loss or damage as a result of the breach;
           c)      any other order that the court considers appropriate.

9.10  When determining whether to seek an order from the Federal Court or the Federal Circuit Court to enforce an undertaking, the Information Commissioner may consider those matters referred to in section 8.11 of these guidelines.

10 Determinations under the Privacy Act

  Legislative basis for making a determination
10.1  Upon completing the investigation of a complaint made under section 36 of the Privacy Act, the Information Commissioner may, under section 52 of that Act, make a determination that either dismisses the complaint or, if the Information Commissioner has found the complaint to be substantiated, make one or more of the declarations specified in paragraph 52(1)(b) of the Privacy Act.
10.2  Upon completing a Commissioner initiated investigation, the Information Commissioner may make a determination that includes one or more of the declarations specified in