Drafting MillworkDrawersThe clockThe method
12 drawers0 lawyersWrite to us
Drawer 05

They refused. Or went quiet.

The grounds for refusing access are ten, listed in APP 12.3. “Commercial arrangements” is not one. Neither is silence.

Subject: Privacy complaint and continuing APP 12 request — [what happened] — [your full name], DOB [your date of birth]

Dear Privacy Officer,

Please treat this email as both a continuation of my access request and a privacy complaint to [the agency].

What happened

On [the date they received it] I requested access under Australian Privacy Principle 12 to the personal information [the agency] holds about me ([their reference]). [what happened].

Why that answer cannot stand

APP 12.3 sets out the grounds on which an organisation may refuse access. The reason I have been given is not among them.

The obligation to give access rests on the entity that holds the information. It does not pass to whoever contracted for the work, and it does not depend on my being your customer. If [the agency] holds my personal information, a contract with someone else does not remove my right to see it. If [the agency] holds nothing about me, it is entitled to say so in writing, and I would accept that.

What I am asking for

  1. Access to the personal information [the agency] holds about me.
  2. If it holds none, a statement to that effect in writing.
  3. If access is refused, the ground in APP 12.3 relied on, identified specifically, with the written reasons APP 12.9 requires.
  4. Confirmation of receipt of this complaint, and a response within 30 days.

I have copied the Office of the Australian Information Commissioner so that the correspondence is on the record. I would rather resolve this with you.

Regards,
[your full name]
[your email]
today

Which body

The same privacy officer, and copy enquiries@oaic.gov.au so the exchange is on the Commissioner’s record. The Commissioner will not take a complaint until you have complained to the company first (s 40(1A)).

Which clock

30 days for them to respond

OAIC, Before you lodge a privacy complaint

Which document

Your request and every reply, in date order.

The receipts
APP 12.3 lists ten grounds on which an organisation can refuse to give access to personal information.OAIC, APP Guidelines, Chapter 12, para 12.33
APP 12.9 provides that if an APP entity refuses to give access … the entity must give the individual a written notice setting out: the reasons for the refusal … the complaint mechanisms available to the individualOAIC, APP Guidelines, Chapter 12, para 12.82
The Commissioner will not investigate a complaint if the person has not first raised the matter with the entity complained about … (s 40(1A)).OAIC, APP Guidelines, Chapter 12, para 12.64
If they don’t respond to your complaint within 30 days or you’re not happy with their response, you can lodge a complaint with us.OAIC, Before you lodge a privacy complaint with us