Privacy and Data Protection Act 2014

After hearing the evidence and representations that the parties to a complaint desire to adduce or make, VCAT may—

find the complaint or any part of it proven and make any one or more of the following orders—

an order restraining the respondent, or the organisation of which the respondents are members of the committee of management, from repeating or continuing any act or practice the subject of the complaint which VCAT has found to constitute an interference with the privacy of an individual;

an order that the respondent perform or carry out any reasonable act or course of conduct to redress any loss or damage suffered by the complainant, including injury to the complainant's feelings or humiliation suffered by the complainant, by reason of the act or practice the subject of the complaint;

an order that the complainant is entitled to a specified amount, not exceeding $100 000, by way of compensation for any loss or damage suffered by the complainant, including injury to the complainant's feelings or humiliation suffered by the complainant, by reason of the act or practice the subject of the complaint;

if the act or practice the subject of the complaint is subject to an approved code of practice, an order that the code administrator take specified steps in the matter, which may include using conciliation or mediation, securing an apology or undertaking as to future conduct from the respondent or the payment of compensation, not exceeding $100 000, by the respondent; or

find the complaint or any part of it proven but decline to take any further action in the matter; or

find the complaint or any part of it not proven and make an order that the complaint or part be dismissed; or

in any case, make an order that the complainant is entitled to a specified amount to reimburse the complainant for expenses reasonably incurred by the complainant in connection with the making of the complaint and the proceedings held in respect of it under this Act.

In an order under subsection (1)(a)(i) or (ii) arising out of a breach of IPP 6.5 or 6.6, VCAT may include an order that—

an organisation or respondent make an appropriate correction to the personal information; or

an organisation or respondent attach to the record of personal information a statement provided by the complainant of a correction sought by the complainant.

If an order of VCAT relates to a public register, the Information Commissioner must, as soon as practicable after its making, report the order to the Minister responsible for the public sector agency or Council that administers that public register.

The Information Commissioner may include in a report under subsection (3) recommendations in relation to any matter that concerns the need for, or the desirability of, legislative or administrative action in the interests of personal privacy.