Amid his varied responsibilities, the Commissioner administers a complaint system and issues Codes of Practice or rules for particular industries, contexts and sectors.

The Act controls the collection, use, disclosure, storage and granting of access to personal information by agencies.

[18] The Information Privacy Principles (IPPs), monitored by the Commissioner, are based on guidelines established by the Organisation for Economic Co-operation and Development (OECD) in 1980.

"[21] The principles do not outline their practical application, giving the Commissioner flexibility to deal with varying fact situations as they arise.

[24] In addition to monitoring compliance with the IPPs and PRPPs, the Commissioner's roles are extensively outlined in Section 13 of the Privacy Act.

[29] Harm can include financial loss, adverse effect on rights or interests, or a significant injury to feelings.

Breaches of principles 6 and 7, the refusal to grant access to or allow correction of information, need not establish harm as these situations are considered interferences per se.

The majority of complaints involved a breach of the IPPs, ahead of the Health Information Privacy Code.

Where settlement is unobtainable or an agency repeatedly contravenes prior assurances, the Commissioner may refer the complaint to the Director of Human Rights Proceedings.

[40] As the IPPs are generally worded, the Commissioner may issue more specific Codes of Practice for different "industries, agencies activities or types of personal information.

The Privacy Commissioner commends the codes as a flexible means of regulation, more readily capable of amendment or revocation than legislative provisions.

The Commission stated that the Privacy Act and common law "cover all the basic principles necessary for an adequate level of protection for natural persons, and also provide for exemptions and limitations to safeguard important public interests.

"[48] The invaluable role of the Commissioner, commended for the position's independence and adequate powers to protect individual privacy, was also noted.