Complaints and review process

An internal review is a formal process to examine the issues raised by an applicant about the handling of their personal information. 

You have the right to an internal review if you have been ‘aggrieved by the conduct of a public sector agency’. This means that you have been negatively affected by something we have done or not done in relation to the privacy of your personal information.

An application for internal review must: 

• be in writing 
• be addressed to DCS  or the business area within DCS to which the complaint relates 
• include a return address in Australia (which will be used to notify you at the completion of the review), and 
• be made within 6 months of becoming aware of the conduct you want reviewed. 

To help you apply for an internal review, you can use the application form from the NSW Information and Privacy Commission (IPC). Although we encourage you to use the form, it is not essential.  

When you submit your application you should include all relevant material, including when the suspected breach occurred, the circumstances of the suspected breach, and the outcomes you are seeking from the review. 

If we are unsure whether you have intended to submit an internal review, we will confirm with you whether the issue you have raised is a request for an internal review. 

You can submit your request for internal review to the business unit concerned, to the DCS Privacy Team by email at privacy@customerservice.nsw.gov.au or by mail to:

DCS Privacy Officer

2-24 Rawson Street

Sydney NSW 2000
 

When we receive an application for an internal review, we will:

• Send you an acknowledgement letter with an expected completion date.
• Advise the NSW Privacy Commissioner of the internal review, provide a copy of the complaint and keep them updated on progress of the internal review. This is a requirement under privacy law.
• Decide who will conduct the internal review. As far as possible, the internal review will be conducted by a person who:
  • was not involved in the conduct which is the subject of the complaint
  • is an employee or an officer of DCS, and
  • is qualified to deal with the subject matter of the complaint.
• Examine all relevant material and, if appropriate, make inquiries with other people within DCS. This may include contacting you to clarify the scope of your application.
• Make findings about the internal review issue/s and determine whether there has been a privacy breach. We may find:
  • insufficient evidence to suggest alleged conduct occurred
  • the alleged conduct occurred but complied with the privacy law
  • the alleged conduct occurred; did not comply with privacy law; but this was allowed by an exemption or similar; OR
  • the alleged conduct occurred and this amounted to a breach under privacy law.
• Decide on any action to be taken.
• Provide the draft internal review report to the NSW Privacy Commissioner and consider any submissions made by them. We will also provide the Commissioner with a copy of the finalised internal review report.

Internal reviews generally follow the process set out in the IPC’s Internal Review Checklist. 

When the internal review is completed, we will notify you of: 

• the findings of the review  
• the reasons for those findings  
• any action DCS proposes to take  
• the reasons for the proposed action (or no action); and  
• your entitlement to have the findings and the reasons for the findings reviewed by NSW Civil and Administrative Tribunal.  

Application – must be made within 6 months of you becoming aware of the conduct. We may accept late applications in certain circumstances (such as if you have only become aware of your right to seek an internal review or for reasons relating to your capacity to lodge an application on time). If we do not accept your application, we will provide our reasons in writing. 

Initial response – we will let you know when that we have received your application within a week. 

Completion of review – we will complete the internal review as soon as practicable but aim to have it completed within 60 calendar days. We will let you know you if we anticipate that the internal review will take longer than the 60 days. 

Outcome – we will let you know the outcome of your review within 14 calendar days of completing the internal review. 

If you require additional support to submit an internal review, or are submitting an application on behalf of someone else, please contact the DCS Privacy Team at privacy@customerservice.nsw.gov.au.   

You have the right to apply to the NSW Civil and Administrative Tribunal (NCAT) if you have sought an internal review and you are not satisfied with: 

• the outcome of the internal review 
• the action taken in relation to your application for internal review; or 
• you do not receive an outcome of the internal review within 60 days. 

You must apply to NCAT within 28 days of receiving the decision from DCS.  

For more information about seeking an external review, visit the NCAT’s website. 

You have the option to complain directly to the NSW Privacy Commissioner if you believe that we have breached your privacy.

The Commissioner’s contact details are:

Postal address: GPO Box 7011, Sydney NSW 2001

Address: Level 15, McKell Building, 2-24 Rawson Place, Haymarket NSW 2000

Telephone:  1800 472 679

Email: ipcinfo@ipc.nsw.gov.au