The Law Handbook 2024

1118 Section 12: Government and the individual information. The exemption does not apply to all the IPPs (e.g. IPP 3 (data quality) and IPP 4 (data security)). In addition to the law enforcement exemption, Victoria Police is also exempt if non-compliance is necessary to carry out its community policing functions. In Smith v Victoria Police (General) [2005] VCAT 654 – which dealt with the matter of the police releasing a mugshot of a convicted person to a newspaper – VCAT held that ‘community policing’ was not limited to activities such as notifying next of kin of a death or investigating missing persons, but could also include activities directed toward community engagement in policing initiatives. • Organisations granted a determination . Organisations granted a public interest determination, or temporary public interest determination, or are party to an information usage arrangement are exempt from needing to comply with the IPPs specified in the determination. • Information Sharing Entities ( ISEs ) and the ‘central information point’, as defined in the Family Violence Protection Act 2008 (Vic) (‘ FVP Act ’), are exempt from certain IPPs and the equivalent Health Privacy Principles (‘ HPPs ’) in the Health Records Act 2001 (Vic) in relation to the collection and disclosure of, and access to, personal information of a perpetrator and alleged perpetrator of family violence (see pt 5AFVPAct). Formore information about the family violence sharing scheme, visit www.ovic.vic.gov.au. The IPPs and any approved Code of Practice give way to any other Act to the extent that they are inconsistent with the other Act. That is, where another Act expressly permits the use and disclosure of personal information, but this is not permitted under the IPPs, the other Act prevails. Complaints to the Victorian Information Commissioner Overview Individuals can complain to the VI Commissioner about an act or practice that may breach a Victorian IPP. The alleged breach must be in relation to the personal information of a living person. There are provisions under the PDP Act that enable minors or people who are unable to complain because of a physical or mental disability to have someone complain on their behalf (ss 59, 60). The VI Commissioner must try to conciliate complaints wherever possible; there are a range of remedies available for the parties’ consideration. Where appropriate, complaints can be referred to the Victorian Ombudsman, the Victorian Health Complaints Commissioner, the Australian Privacy Commissioner, theDisability Services Commissioner, the Commissioner for Children and Young People, or the Mental Health Complaints Commissioner. Note that for complainants who are in prison custody, communications to and from the VI Commissioner, most of the complaint bodies listed above, and a number of other entities, are treated as privileged communications under the Corrections Act 1986 (Vic). Under the Freedom of Information Amendment (Office of the Victorian Information Commissioner) Act 2017 (Vic) (‘ FoI Amendment Act 2017 ’), the VI Commissioner can investigate complaints received under the PDP Act as if received under the FoI Act (Vic) and vice versa. In conducting investigations, the VI Com­ missioner has enforceable powers to obtain information and documents, and to take evidence on oath. The FoI Amendment Act 2017 enhanced these powers and they apply to all the VI Commissioner’s investigations. The VI Commissioner has the power to decline to investigate and conciliate complaints in certain circumstances (s 62). These include where: • the organisation complained about is adequately dealing with, or has adequately dealt with, the complaint; • the complainant has not complained to the organisation before making a complaint to the VI Commissioner; • the VI Commissioner believes the complaint is frivolous, vexatious or lacking in substance; or • the complainant does not make a complaint to the VI Commissioner within 45 days of becoming aware of the alleged privacy breach. Traditionally – and in relation to the ground of ‘complainant delay in bringing a complaint’ – the VI Commissioner has exercised this discretion sparingly (i.e. in away that is favourable to complainants who have not met the 45-day timeframe). If an alleged privacy breach is done by an employee or an agent acting on behalf of an organisation, the