The Queensland Information Privacy Act 2009 (the Act) provides a right for individuals to have their personal information collected and handled in accordance with certain rules or ‘privacy principles’.
The privacy principles only apply to Queensland Government agencies. The Act does not cover actions by individual citizens, private sector organisations or the community sector. Organisations with an annual turnover of more than $3 million and private sector health service providers are subject to the Australian Government's privacy legislation.
Personal information is any information about a person who can reasonably be identified (e.g. your name, address, phone number, email address, date of birth or photograph).
The privacy principles include:
The Office of the Information Commissioner (OIC) is an independent body that promotes privacy rights and obligations under the act.
Find out more about privacy principles and how they apply to certain situations, such as using drones or camera surveillance.
We must only collect information that is directly related to, and necessary for, our functions and activities. We must do so in a way that:
We must also take reasonable steps to make you aware (before or at the time of collecting):
When a government agency stores information, we must protect it from misuse, including unauthorised:
We must make sure you can easily find out what information we hold about you and how we use it.
If you ask us, we must give you access to your personal information and allow you to amend it, unless it is contrary to the public interest to do so.
When using or disclosing your personal information, we must first take reasonable steps to check it is correct and up to date. We can’t:
These circumstances include if:
The privacy principles for health agencies cover the same actions of collection, storage, use and disclosure; however, they contain different obligations.
For example, health agencies may only collect sensitive information (e.g. health information) in specific circumstances. A health agency may also give your personal information to someone outside the agency without relying on a permitted exception if the disclosure is for the purpose for which the information was obtained in the first place.
There are exceptions to the privacy principles, which are explained in the Act. This ensures we can continue to carry out our legitimate business dealings.
Only some of the privacy principles apply to:
If you believe that we have handled your personal information in a way that is not consistent with the privacy principles, you have the right to make a privacy complaint.
Before making a formal privacy complaint, try talking with the relevant business area in the agency―this is often the quickest and easiest way to address your concerns.
If you are not satisfied with their response, you can make a formal written privacy complaint through the complaints process set up by the agency, explaining the act or practice you are concerned about. It is a good idea to keep a copy of the complaint for your records.
After 45 business days, you can take your privacy complaint to the OIC if you:
You can lodge your complaint with the OIC online, by post or by email. The privacy complaint checklist contains a series of questions to help you work out if the OIC can deal with your complaint.
You must make your complaint in writing. If you need help to put your complaint in writing, call (07) 3234 7373 between 8.30am and 4.30pm weekdays.
Your written complaint must include:
Attention: Privacy team
Office of the Information Commissioner
PO Box 10143
Adelaide Street
BRISBANE QLD 4000
Level 7
133 Mary Street
BRISBANE QLD 4000
You should receive notice from the OIC that your privacy complaint has been received within 5 business days. The OIC will then assess whether the subject matter of your complaint shows an ‘arguable case’ that a privacy breach has occurred. They will then provide you with a written notice that sets out the reason for their decision.
If the OIC accepts your complaint, they will work with you and the respondent agency to agree on options that will resolve the complaint (mediation).
If it appears to the OIC that mediation is not likely to resolve your complaint, you can ask for your complaint to be referred to the Queensland Civil and Administrative Tribunal (QCAT).
If a privacy complaint is referred to QCAT, you and the respondent agency will be the parties to the hearing before QCAT.
If the OIC does not accept your complaint, there are no more options available for you to continue your complaint under the Act.
Last updated: 28 June 2023