Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.
We respect your Do Not Track preference.
The Privacy Commissioner frequently investigates complaints about businesses or organisations failing to give people access to their personal information. After an investigation, the Privacy Commissioner will be able to make binding decisions on these complaints and issue an access direction to the business or organisation concerned.
An access direction is a binding written notice issued to a business or organisation by the Privacy Commissioner. The notice directs the business or organisation to release personal information to an individual.
The Commissioner can issue an access direction if there has been an investigation of a principle 6 complaint and the Privacy Commissioner has determined that the person is entitled to some or all of the personal information they requested.
An access direction could require an organisation to:
Before issuing an access direction the Commissioner will typically notify the organisation of the complaint about how it has responded to an access request under principle 6 of the Privacy Act, investigate that complaint, and use best endeavours to try to settle the complaint. The Commissioner may review any material at issue and may form a preliminary view on an access complaint made under principle 6.
All access directions will outline the steps or conditions the business or organisation needs to take to comply. This will include what information the business or organisation needs to release, the process they need to follow, and the date by which they must take those steps.
The Privacy Commissioner will provide the organisation concerned with a reasonable opportunity to comment on and respond to an access complaint that the Commissioner is investigating. The Commissioner will determine an appropriate period for comment, considering relevant circumstances.
The Commissioner may provide a draft access direction and an opportunity to comment before making the access direction; however, this will depend on the circumstances.
If a business or organisation receives an access direction, it must take steps to comply as soon as possible. If a business or organisation disagrees with an access direction, it can appeal to the Human Rights Review Tribunal. An appeal must be lodged within 20 working days of receiving the notice.
In some instances an access direction will be made public. If the Commissioner considers it is in the public interest, the identity of the organisation and the details of the access direction may be published on our website.
If publication of details of the access direction would be adverse to the organisation concerned, the Commissioner must first give the organisation an opportunity to be heard.
The Commissioner also reports at least annually on the activities of the Office. It is likely that access issues, including the number of access directions issued and top organisations by volume of complaints, will form part of future reporting.
If an organisation does not comply with an access direction, an individual may apply for an enforceable access order from the Human Rights Review Tribunal. The Commissioner may support an individual to make an application to the Tribunal for an access order.
If the Tribunal issues an access order requiring the organisation to comply with the access direction and an organisation fails to comply with the access order, the agency commits an offence and is liable on conviction to a fine of up to $10,000.
If an organisation disagrees with an access direction, it can appeal all or part of the access direction in the Tribunal.
The parties to any appeal are the parties to the investigation, but the Commissioner has a right to be heard in any appeal of an access direction before the Tribunal.
An individual can also bring proceedings in the Tribunal within six months for other remedies, (including damages) whether an access direction has been issued or not. If an access direction has been issued, an individual can bring proceedings in the Tribunal within six months whether they are satisfied with the access direction or not.
Download this information as a PDF here.
Our full Access Directions Guidlines are here.
