Section 23B — Privacy Act 1988: Dealing with complaints

(1) If an individual makes a complaint under section 23A, the respondent for the complaint: (a) must, within 7 days after the complaint is made, give the individual a written notice that: (i) acknowledges the making of the complaint; and (ii) sets out how the respondent will deal with the complaint; and (b) must investigate the complaint. Consultation about the complaint (2) If the respondent for the complaint considers that it is necessary to consult a credit reporting body or credit provider about the complaint, the respondent must consult the body or provider. (3) The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection. Decision about the complaint (4) After investigating the complaint, the respondent must, within the period referred to in subsection (5), make a decision about the complaint and give the individual a written notice that: (a) sets out the decision; and (b) states that, if the individual is not satisfied with the decision, the individual may: (i) access a recognised external dispute resolution scheme of which the respondent is a member or to which it is subject; or (ii) make a complaint to the Commissioner under Part V. (5) The period for the purposes of subsection (4) is: (a) the period of 30 days that starts on the day on which the complaint is made; or (b) such longer period as the individual has agreed to in writing.