Privacy and Data Protection Act 2014

The Information Commissioner may serve a compliance notice on an organisation, if it appears to the Information Commissioner that—

the organisation has done an act or engaged in a practice in contravention of an Information Privacy Principle (including an act or practice that is in contravention of an applicable code of practice) or an approved information usage arrangement; and

the act or practice—

constitutes a serious or flagrant contravention; or

is of a kind that has been done or engaged in by the organisation on at least 5 separate occasions within the previous 2 years.

A compliance notice requires the organisation to take specified action within a specified period for the purpose of ensuring compliance with the Information Privacy Principle, applicable code of practice or approved information usage arrangement.

If the Information Commissioner is satisfied, on the application of an organisation on which a compliance notice is served, that it is not reasonably possible to take the action specified in the notice within the period specified in the notice, the Information Commissioner may extend the period specified in the notice on the organisation giving the Information Commissioner an undertaking to take the specified action within the extended period.

The Information Commissioner may only extend a period under subsection (3) if an application for the extension is made before the period specified in the notice expires.

The Information Commissioner may act under subsection (1) on the Information Commissioner's own initiative or on an application by an individual who was a complainant under Division 8.

In deciding whether or not to serve a compliance notice, the Information Commissioner may have regard to the extent to which the organisation has complied with a decision of VCAT under Subdivision 5 of Division 8.

A compliance notice must be served in accordance with section 83C.