Skip to content
Close

The Victorian Managed Insurance Authority (VMIA) is committed to maintaining the privacy of individuals’ personal information and always seeks to ensure it fully complies with its obligations under the Privacy and Data Protection Act 2014 and the Health Records Act 2001.

The Information Privacy Principles (IPP’s) are the foundation of privacy law in Victoria and sets out the minimum standard for how VMIA should handle, hold, access, use and correct personal information. 

Making a privacy complaint

These procedures are not intended to apply to requests for access to, or correction of, personal information held by VMIA.

What should I do before making a privacy complaint?

We can only investigate privacy complaints in relation to its acts or practices or the acts or practices of our contracted service providers. As such, please ensure your complaint falls within the scope of the Privacy Complaint Handling Procedures and by referring to the IPP’s and/or the HPP’s.

Please note that for the protection of everyone’s privacy, we only accept complaints made by the persons directly affected or an authorised representative. As such, if you wish to make a privacy complaint on someone’s behalf, please provide proof of authority to do so.

How do I make a privacy complaint?

If you believe that VMIA or one of its contracted service providers has not dealt with your personal information in accordance with Information Privacy Principles (IPP), you can make a privacy complaint with us.

To ensure that we fully understand the nature of your privacy complaint and the outcome you are seeking, we prefer that you make your privacy complaint in writing.

A privacy complaint can be made to us in any of the following ways:

Online complaints form

You can fill in details of your complaint using the online VMIA Privacy Complaint Form. Once submitted we will review and respond. This is the most efficient way of submitting your complaint.

Download a complaints form

You can download a PDF of the VMIA Privacy Complaint Form [PDF, 161KB]. You can then submit it to us in the following ways;

Via email:

You can email your privacy complaint to privacy@vmia.vic.gov.au

Via mail:

You can mail your complaint to our Privacy Officer.

VMIA
Level 10 South
161 Collins Street
Melbourne VIC 3000

If you require more assistance you can call VMIA on (03) 9270 6900.

What information should I include in my privacy complaint?

So that we can properly and efficiently respond to your privacy complaint you should ensure that your complaint contains sufficient information to enable us to understand the nature of your complaint and the outcome you are seeking. To assist you in this regard, things you may wish to consider include:

  • What happened?
  • When did it happen or come to your attention?
  • Where did it happen?
  • Who was involved?
  • What IPPs and/or HPP’s do you believe have been breached?
  • How do you believe your personal information has been mishandled?
  • What outcome are you seeking?

Anonymous complaints

Please note that we will generally not accept anonymous complaints. Transparency is essential for effective resolution and accountability. By requiring identification, we ensure that all parties involved can engage in a constructive dialogue, allowing us to thoroughly investigate the issue and take appropriate action. This approach also fosters a culture of trust and responsibility.

Third parties

It may be necessary to contact any third parties named in your privacy complaint in the course of conducting the investigation. This may necessitate disclosing the nature of your privacy complaint and your identity. You can advise us that you do not wish for us to do this, however, please be aware that this may mean we cannot properly investigate and resolve your privacy complaint.

How long will it take for a response?

We will acknowledge your privacy complaint within 2 business days of it being received by our Privacy Officer.

How long it takes for our Privacy Officer to investigate your privacy complaint and respond to you will ultimately depend on the nature and complexity of the issues involved.

Generally, we will provide you with written notification of the outcome of our investigation into your privacy complaint within 15 business days. We will provide you with an update on the progress of your complaint if we anticipate it will take longer than 15 business days to advise you of the outcome of the investigation.

What happens if I am not satisfied with the response I receive?

If you are unhappy with our response to your privacy complaint you can lodge a written complaint with the Office of the Victorian Information Commissioner (OVIC) in relation to a complaint relating to personal or sensitive information:

Postal address: PO Box 24274, Melbourne VIC 3001
Phone: 1300 006 842 (1300 00 OVIC)
Email: enquiries@ovic.vic.gov.au
Website: Office of the Victorian Information Commissioner (OVIC)

In relation to a complaint relating to health information you can lodge a written complaint with the Health Complaints Commissioner (HCC):

Postal address: Level 26, 570 Bourke Street, Melbourne VIC 3000
Phone: 1300 582 113
Translating and interpreting service phone: 131 450
Website: Health Complaints Commissioner (HCC)

Privacy complaint handling procedures

If we receive a privacy complaint, the following procedures will apply:

  • If a verbal privacy complaint is received via telephone, we will encourage the complainant to submit their complaint in writing to the Privacy Officer, using the VMIA’s Privacy Complaint Form. If the complainant is unwilling to submit a written complaint, then the officer receiving the complaint should:
  • document the verbal complaint in writing;
  • capture the complainant’s contact details for the purposes of contacting them in relation to their privacy complaint. At a minimum this should include the complainant’s telephone number, an email or postal address;
  • advise the complainant that details of the privacy complaint and their contact details will be forwarded to the Privacy Officer for the purposes of assessing, investigating, conciliating, and reporting on the privacy complaint;
  • if the complainant is unwilling to provide their contact details or would like to use a pseudonym or be anonymous, advise the complainant that it may be difficult to properly investigate or respond to their complaint and it will not be possible to provide a response to the complainant;
  • refer the privacy complaint promptly to the Privacy Officer.
  • If a written privacy complaint is received, the complaint will be forwarded to the Privacy Officer.  

The Privacy Officer will undertake the following next steps:

  • acknowledge the individual’s privacy complaint within 5 business days of the complaint having been received by them;
  • liaise with the complainant as appropriate to seek any relevant information necessary to investigate the privacy complaint and to identify the outcome the complainant is seeking;
  • where appropriate, brief the legal team and business area on the privacy complaint;
  • impartially assess and investigate the privacy complaint in consultation with the relevant business area.
  • appropriately document the investigation process;
  • advise the complainant of the outcome of the investigation and the proposed action, if any, intended to be taken;
  • provide the complainant with information on how to make a complaint to the Office of the Victorian Information Commissioner (OVIC) if they are unhappy with the outcome of the investigation.

If the outcome of the investigation concludes that VMIA or one of its contracted service providers appears to have mishandled an individual’s personal information, consult with the relevant line area over what steps are appropriate to take to ensure a similar incident does not occur again.

Privacy Collection Notice

The personal information collected from you on this form is collected by VMIA for the purposes of assessing, investigating, conciliating, and reporting on your privacy complaint. VMIA may collect information about you from other individuals or organisations involved in the complaint for the above purposes.

VMIA may disclose the information you give us to the individuals or organisations named in the privacy complaint and, if necessary, to others who have information relevant to your complaint. In case of a challenge to VMIA’s conduct connected with your privacy complaint, VMIA may need to disclose some of your personal information to a review body, for example, the Office of the Victorian Information Commissioner or other court or tribunal. VMIA is not likely to disclose your personal information to any overseas recipients unless your complaint relates to an overseas contracted service provider of VMIA.

You are encouraged to provide VMIA with your contact details when you make a privacy complaint. If you do not provide your contact details, we may not be able to properly investigate your complaint or inform you of the action, if any, taken in response to your complaint.

VMIA’s Privacy Policy contains information about how you may access your personal information held by the VMIA. This Privacy Policy also contains information on how you can complain about an incident or potential breach of the Information Privacy Principles (IPPs) and/or the Health Privacy Principles (HPPs), and how VMIA will deal with such a complaint. Please refer VMIA Privacy Policy [PDF, 160KB].