Privacy Management Plan – 5. The Internal Review Process

If an individual believes that the University has breached, or is likely to breach, one or more of the IPPs, he or she may submit a written request to the University to investigate the matter. The following procedures will be used to resolve an application for internal review.

• The application is assessed by the University's Privacy Officer to determine whether the complaint involves a breach of privacy.
• The Privacy Officer notifies the Privacy Commissioner in writing that an application for internal review has been received.
• The Privacy Officer (or another person appointed by the Registrar if the matter happened to involve the Privacy Officer) investigates the matter by considering all relevant material supplied by the applicant and the Privacy Commissioner.
• Each fortnight, the Privacy Officer informs the Privacy Commissioner in writing about progress of the review.
• The review will be completed as soon as possible, and in any case within 60 days of receiving the application.
• The Privacy Officer notifies the applicant of the following (as appropriate):
  • findings of the review
  • reasons for those findings
  • a formal apology from the University
  • remedial action to be undertaken by the University (which may include compensation)
  • the University's undertaking that the breach of privacy will not recur
  • administrative measures that will be implemented to ensure no further breach of privacy
  • reasons for the proposed remedial action and administrative measures
  • the applicant's right to have the findings and the University's proposed remedial action and administrative measures reviewed by the Administrative Decisions Tribunal.
• The Privacy Officer notifies the Privacy Commissioner in writing of the findings and of any remedial action and administrative measures that the University proposes to undertake.

The Privacy Officer will initiate administrative measures to ensure that the breach does not recur. Where appropriate, new or revised procedures may be incorporated into the Privacy Management Plan.

Privacy Management Plan home   |   Next   |   Previous