(1) Subject to subsection (1A), the Commissioner shall investigate an act or practice if:
(a) the act or practice may be an interference with the privacy of an individual; and
(b) a complaint about the act or practice has been made under section 36.
(1A) The Commissioner must not investigate a complaint if the complainant did not complain to the respondent before making the complaint to the Commissioner under section 36. However, the Commissioner may decide to investigate the complaint if he or she considers that it was not appropriate for the complainant to complain to the respondent.
(1B) Subsection (1A) does not apply if the complaint is about an act or practice that may breach:
(a) section 20R, 20T, 21T or 21V (which are about access to, and correction of, credit reporting information etc.); or
(b) a provision of the registered CR code that relates to that section.
(2) The Commissioner may, on the Commissioner's own initiative, investigate an act or practice if:
(a) the act or practice may be an interference with the privacy of an individual or a breach of Australian Privacy Principle 1; and
(b) the Commissioner thinks it is desirable that the act or practice be investigated.
(3) This section has effect subject to section 41.