-
On this page
The OAIC acts as an impartial third party when investigating and resolving a Consumer Data Right (CDR) complaint. We don’t act for you or the business you complained about.
Deciding if we can investigate your complaint
Before we decide whether to investigate your complaint, we may need more information. In this situation, we may contact you, the business you complained about, or any relevant third party to collect more information about your complaint. If we think we can resolve your complaint during this process, we will attempt to do so.
If your complaint is about something we can’t investigate, we will let you know and close your complaint. You can appeal our decision.
We can’t investigate an anonymous complaint.
What we may not investigate
Generally speaking, we may not investigate your complaint if:
- it doesn’t involve your CDR data
- the CDR system doesn’t cover the act or practice you’re complaining about
- you haven’t first complained to the business you think has mishandled your data or they haven’t had an opportunity to respond to your complaint
- you are complaining about something you found out about more than 12 months ago
- the matter is best dealt with by an external dispute resolution scheme recognised by the Australian Competition and Consumer Commission to consider a complaint related to the CDR
- the matter is best dealt with under another law or by another agency or organisation.
We’re unlikely to investigate a complaint about a matter that occurred more than 12 months ago because it can be hard to investigate effectively and fairly for both parties. For example, the people involved in the matter may no longer be about to recollect what occurred, or the quality and availability of relevant information may be compromised or no longer exist.
We may, however, investigate your complaint if you have a good reason for not lodging it within 12 months of becoming aware of the act or practice. For example, you’ve been trying to resolve the matter with the business since it occurred.
We’re unlikely to investigate a complaint if a dispute resolution body that is recognised to handle a CDR complaint is currently dealing with the same complaint.
Investigating your complaint
If we decide to investigate your complaint, we will usually write to the business you complained about. We will tell them about your complaint and ask for their response. We will also give them a copy of your complaint to us.
We will let you know, in writing, of the progress of your complaint.
If necessary, we may also disclose your personal information to any third party who has information relevant to your complaint. This may include the ACCC, which also regulates the Consumer Data Right system.
If we think we may need to disclose your personal information to an overseas organisation or agency, we will discuss this with you first.
We may need to collect more information from you to investigate your complaint. If you don’t give us this information, it may affect how we handle your complaint. In some situations, it may mean we decide not to investigate your complaint any further.
We will usually collect information about you from the business you complained about. We may also collect information about you from others if they have information relevant to your complaint.
If you have any questions about the information we collect about you and how we will handle it, please read our privacy policy or contact us.
Resolving your complaint
Generally, we will discuss the issues you raised in your complaint with you and the business you complained about. You need to tell us the outcome you want.
We will try to get both you and the business you complained about to agree on an outcome, rather than us deciding what should happen. There are many possible outcomes.
If you and the business you complained about agree on an outcome to resolve your complaint, we will close your complaint. If you and the business you complained about can’t agree on an outcome, we will decide what should happen.
If we think the business you complained about has proposed a reasonable outcome but you are not happy with it, we may close your complaint because the business has adequately dealt with the matter, even though you don’t agree.
If we don’t think the matter has been resolved or the business you complained about hasn’t adequately dealt with the matter, we will make a formal decision, called a determination, which states what the business must do.
You can choose to withdraw your complaint at any time without penalty.
If you’re not happy with the outcome of your complaint, you have complaint review rights.
Possible outcomes
A possible outcome for a complaint may be:
- taking steps to address the matter, such as having a record corrected
- an apology
- a change to the practices or procedures of the business you complained about
- training staff
- compensation for financial or non-financial loss
- other non-financial options, such as a complimentary subscription to a service.
In some situations, we may also accept an undertaking from the business to do, or stop doing, a specific thing so they don’t breach the CDR privacy safeguards. If they fail to meet the undertaking, we can ask a court to enforce it.
Where a breach of the CDR privacy safeguards is very serious, we may seek a civil penalty. A civil penalty is like a fine and is not paid to you.
