Can the Privacy Commissioner check up on how my data is being handled during an investigation?

In your situation involving the retail company's data breach from February, the Privacy Commissioner is not limited to the generic responses you received from customer service. Under the law, the Commissioner has specific 'monitoring powers' that allow them to oversee how information is being handled during formal processes. Specifically, if the Commissioner is conducting an assessment regarding the Australian Privacy Principles (the rules for how companies handle personal data), the information provided is subject to monitoring [cite:au-privacy-1988-sec80tb]. This means there is a formal oversight mechanism in place. Furthermore, if the Commissioner is conducting an assessment, they have the power to demand specific evidence. The law states the Commissioner may "require the entity or file number recipient to give the information or produce the document within the period specified in the notice" [cite:au-privacy-1988-sec33c]. This means the company must hand over the actual documents or data requested, rather than just providing verbal assurances. During an investigation, the Commissioner's powers are even broader. They may "obtain information from such persons, and make such inquiries, as he or she thinks fit" [cite:au-privacy-1988-sec43]. This allows the Commissioner to dig deeper into the company's actual security measures and data handling practices to see if they truly complied with the law. It is important to note that while the Commissioner has these powers, the law does not specify exactly how much detail they will share with you personally regarding the specific documents they have reviewed from the retail company. The Commissioner's role is to oversee the company's compliance, not necessarily to act as your personal data auditor.