Privacy complaints
If you believe that Queensland Health (‘the department’) has not followed the rules in the Information Privacy Act 2009 (IP Act) with your personal information, you can make a privacy complaint.
You can only make a privacy complaint on behalf of another person if they have authorised you to do so, they are a minor/child and you are their parent or guardian, they lack capacity, and you are their guardian or have other legal authority to act for them. If you are making a privacy complaint for someone else, please include an authority from them or other evidence (e.g. a birth certificate showing they are a minor/child, and you are their parent).
We will need your privacy complaint to:
- be in writing
- include a contact address so that we can reply (an email address is sufficient)
- be about how we have handled your personal information (not someone else’s information)
- describe what the department did with your personal information that you think broke the rules in the IP Act
- contain enough information to enable us to understand the details of your privacy complaint, the impact it has had on you, and what outcome you are seeking or the action you want us to take.
It’s best to make your privacy complaint as soon as you are aware that your privacy may have been breached. The earlier you tell us, the sooner we can act.
A privacy complaint must be made within 12 months after you become aware of the act or practice the subject of the complaint, or a longer period agreed by our agency. If you wish to complain about an act or practice that took place more than 12 months ago, tell us the reason for the delay when lodging your privacy complaint.
We will investigate your privacy complaint and advise you of the outcome within 45 business days. To address your privacy complaint, we will need to disclose the details of the privacy complaint and your identity to relevant business areas within the department and third parties. By proceeding with your privacy complaint, you indicate your consent for us to do this.
Attach copies of any documents you consider may assist the department to investigate your privacy complaint.
Hospital or Health Service privacy complaint
If your complaint is about the way a Hospital and Health Service (HHS) has dealt with your personal information, you will need to contact them directly.
Find the privacy contact for your HHS.
Contact address for privacy complaints for the Department of Health
Your privacy complaint should be marked “Private and Confidential” and sent:
By post:
Principal Privacy Officer
Privacy and Right to Information Unit
Queensland Health
GPO Box 48
BRISBANE QLD 4001
By email:
Responding to your privacy complaint
An acknowledgement letter or email will be sent to you within 5 business days of the receipt of the privacy complaint. To make sure your personal information is protected, we take precautions to verify the identity of complainants. We may request that you provide sufficient evidence of identity in order to progress with your complaint. If we require further information, we will contact you.
We will then respond within 45 business days outlining our decision and reasons for this decision.
However, if your privacy complaint is complex or requires extensive work and consultation, we may not be able to respond within 45 business days. If this happens, we will write to you requesting an extension for a further specified period.
Withdraw a privacy complaint
If you wish to withdraw a privacy complaint, it must be in writing. We may still continue with the assessment if the privacy complaint involves a serious or significant issue that requires further management.
Further action
If you are not satisfied with our response, or have not received a response, and at least 45 business days have passed since the privacy complaint was made in writing to the department, you can refer the privacy complaint to the Office of the Information Commissioner (OIC) Queensland.
This can be done through the online complaints form or in person, post or email.
Find out more about lodging a privacy complaint with the OIC.