organisation you are complaining about in order to enable them to respond to your complaint. The complainant(s) The complainant is the person whose privacy has been interfered with. Name of the complainant(s) The respondent The respondent is the organisation that interfered with the complainant’s privacy. The respondent is: a Victorian Government organisation, a local council, or a contracted service provider to a Victorian Government organisation or a council. Name of respondent organisation Address (if known) Telephone number (if known) What is the respondent’s relationship to the complainant? (eg: employer, service provider, local council, law enforcement) Acknowledgement that OVIC will contact the respondent to discuss your complaint The PDP Act requires the Information Commissioner to notify the respondent of your complaint as soon as practicable we receive it. I understand that OVIC will contact the respondent organisation to discuss my complaint. I understand that OVIC may provide a copy of my complaint to the respondent organisation. Which Information Privacy Principle (IPP) has been breached? This page provides a summary of organisations’ obligations under the IPPS to assist you to formulate your complaint. The full text of the IPPs can be found in Schedule 1 to the PDP Act, or on the OVIC website. IPP 1 — Collection The respondent collected personal information me: that was not necessary for one or more of their functions or activities. by unlawful or unfair means, or in an unreasonably intrusive way. without providing proper notice about the collection (proper notice should include information about the purposes for which the information is collected and who it is usually disclosed to). from a party when it would have been reasonable and practicable to collect the information from me directly. IPP 2 — Use and disclosure The respondent used my personal information inappropriately. The respondent disclosed my personal information inappropriately. IPP 3 — Data quality The respondent did not take reasonable steps to make sure that the personal information it collected, used or disclosed about me was accurate, complete and up to date. IPP 4 — Data Security The respondent did not take reasonable steps to protect the personal information it held about me from misuse and loss and from unauthorised access, modification or disclosure.
IPP 5 — Openness The respondent does not have a privacy policy. The respondent refused my request for general information about the sort of personal information it holds, for what purposes, and how it collects, holds, uses and discloses that information. IPP 6 — Access and Correction I requested access to personal information contained in documents that are not subject to the Freedom of Information Act 1982 (Vic) and the respondent: Did not respond within 45 days. Denied access without providing reasons. Denied access for a reason that that I disagree with. Refused to correct the personal information without providing reasons. Refused to take reasonable steps to annotate the information. IPP 7 — Unique Identifiers The respondent inappropriately assigned, adopted, used or disclosed a unique identifier for me. The respondent inappropriately required me to provide a unique identifier in order to obtain a service. IPP 8 — Anonymity The respondent did not allow me to deal with them anonymously, even though it would have been lawful and practicable to do so. IPP 9 — Transborder Data The respondent transferred my personal information to someone outside Victoria without taking adequate steps to ensure that it would be protected, and without my consent. IPP 10 — Sensitive Information The respondent collected ‘sensitive information’ about me without proper justification. ‘Sensitive information’ means information about: racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices, or criminal record. Describe the act or practice that you would like to complain about It will assist us if you can explain: what happened, when it happened (including dates if you know them), what personal information of was involved, who did it (include names of individuals involved if you know them), and how and when you found out about it.