Privacy Statement
Context and purpose
This Privacy Statement explains how the Office of the Independent Review Officer (IRO) collects, uses, stores and protects your personal information and health information. We are committed to protecting your privacy and handling your information in an open and transparent way.
When you interact with us—such as making an enquiry, lodging a complaint, or seeking assistance with a claim—we may collect personal and health information to provide you with our services and perform our statutory functions.
We manage your information in accordance with the:
- Privacy and Personal Information Protection Act 1998
- Health Records and Information Privacy Act 2002.
What we do
The IRO is an independent statutory office that:
- helps injured workers and persons injured in motor vehicle crashes to resolve complaints about insurers
- administers legal funding for eligible applicants
- works to improve outcomes in the personal injury schemes
How we handle your information
Collecting your information
We collect personal and health information to:
- respond to enquiries and information requests
- manage and resolve complaints
- assess eligibility for legal funding
- carry out our statutory functions
- improve our services
We only collect the information we need to provide our services. Where appropriate, we will provide a Privacy Collection Notice at the point of collection explaining:
- why the information is being collected
- how it will be used and shared
- your rights in relation to that information
How we collect information
We may collect information:
- directly from you
- from your lawyer, insurer or other representatives
- from a third party where necessary to perform our functions.
- If you choose not to provide certain information, we may not be able to assist you.
Types of information we collect
The types of information we collect may include:
- personal details (such as name, date of birth and contact details)
- information about your injury, treatment and health circumstances
- information about your employment and income
- information related to your complaint, claim or legal funding application
Using and disclosing your information
We use your information to deliver IRO services and perform our functions.
We may share your information with relevant parties where necessary, including:
- insurers
- legal representatives
- medical or allied health providers
- other government agencies
We will only disclose your information where:
- it is directly related to our functions
- you have provided consent, or
- it is required or authorised by law
We may disclose your personal information to the State Insurance Regulatory Authority (SIRA) where necessary to enable both SIRA and us to perform our legislative functions.
We may also use de‑identified information from complaints and grant applications for education, awareness, reporting and training purposes. This information will not be used in a way that could reasonably identify you.
Surveys
From time to time, we may invite you to voluntarily participate in surveys about our services and advice.
These surveys may collect personal and demographic information where relevant. Participation is optional.
Some surveys may be administered by third-party providers on our behalf. Where this occurs, we take reasonable steps to ensure these providers comply with applicable privacy laws, have appropriate privacy policies in place, and store information securely.
If you choose to participate, you may provide personal information such as your contact details, feedback, or information about your experience. We may request additional information where needed to better understand your feedback.
Audits and reporting
We may use your information for internal audits, quality assurance and reporting activities. This helps us meet our legal and accountability obligations and supports ongoing improvement of our services.
Protecting your information
We take reasonable steps to protect your information from misuse, loss, unauthorised access, modification or disclosure. Information is stored securely in electronic systems with appropriate access controls. Only authorised personnel can access your information.
Accessing your personal information
You have the right to
- request access to your personal or health information
- request corrections if the information is inaccurate, incomplete or out of date
In some cases, you may be asked to seek access directly from a third party (such as your lawyer or insurer) where they originally provided the information.
Read more information about Accessing information.
Making a privacy complaint
If you have concerns about how we have handled your personal information, you can contact us to make a complaint.
We will assess your complaint and respond in accordance with our obligations under NSW privacy laws.
Further information about how to make a complaint is available on our website.
You may also contact the NSW Privacy Commissioner for further information about your privacy rights.
Updates to this statement
We may update this Privacy Statement from time to time to reflect changes in legislation, technology or our services.
Further information
The IRO is an independent office and agency within the Customer Service portfolio.
You can find more information about how we manage personal and health information in our Privacy Management Plan, available on our website.
For general information about your privacy rights and the Privacy and Personal Information Protections (PPIP) Act 1998 (NSW), you can also visit the Information and Privacy Commission (NSW) website.
Information about the Mandatory Notification of Data Breach Scheme which commenced in NSW on 28 November 2023 is available in our IRO Data Breach Policy.