Victorian Consolidated Legislation

Information Privacy Act 2000 - SECT 44

PART 6 ENFORCEMENT OF INFORMATION PRIVACY PRINCIPLES

Compliance notice

44. Compliance notice



(1) The Privacy Commissioner may serve a compliance notice on an organisation,
if it appears to him or her that-

   (a)  the organisation has done an act or engaged in a practice in
        contravention of an Information Privacy Principle, including an act or
        practice that is in contravention of an applicable code of practice;
        and

   (b)  the act or practice-

   (i)  constitutes a serious or flagrant contravention; or

   (ii) is of a kind that has been done or engaged in by the organisation on
        at least 5 separate occasions within the previous 2 years.

(2) A compliance notice requires the organisation to take specified action
within a specified period for the purpose of ensuring compliance with the
Information Privacy Principle or applicable code of practice.

(3) If the Privacy Commissioner is satisfied, on the application of an
organisation on which a compliance notice is served, that it is not reasonably
possible to take the action specified in the notice within the period
specified in the notice, the Privacy Commissioner may extend the period
specified in the notice on the giving to him or her by the organisation of an
undertaking to take the specified action within the extended period.



(4) The Privacy Commissioner may only extend a period under subsection (3) if
an application for the extension is made before the period specified in the
notice expires.

(5) The Privacy Commissioner may act under subsection (1) on his or her own
initiative or on an application by an individual who was a complainant under
Part 5.

(6) In deciding whether or not to serve a compliance notice, the Privacy
Commissioner may have regard to the extent to which the organisation has
complied with a decision of the Tribunal under Division 5 of Part 5.