Posting a photo without consent. What actually happens.

Realistically, no. The regulator can seek a civil penalty and says it does so "where a breach of privacy is very serious", which is not one photo posted from a stale consent form and taken down when someone pointed it out. It also notes a civil penalty is not paid to the person complaining, so there is nothing in it for the family. The outcomes the regulator actually lists for a complaint are an apology, a change to your procedures, staff training, sometimes compensation, and sometimes no result. Any page waving a maximum penalty at you is selling you something.

No. The instruction is direct: if you think an organisation has mishandled your personal information, you must complain to them first. The regulator also asks people to allow a reasonable time for a response and says it considers 30 days reasonable. If a service has not had the chance to respond, that is one of the listed reasons the regulator may not investigate. So the first conversation is always yours, and it is the one that decides almost every one of these.

For a privacy complaint, the regulator lists among its reasons for not investigating that the person is "complaining about something you found out about more than 12 months ago". Note the wording: it runs from when they found out, not from when you posted, so an old photo someone discovers today is not automatically out of time. Separately, the statutory tort that began in June 2025 has a much longer window where a child is involved, with proceedings able to start any time before their twenty-first birthday. The practical answer is to go and look at what is still up rather than to work out whether you are technically safe.

Take it down first, then talk. Say specifically what happened rather than calling it an administrative oversight, because families can tell the difference and the specific version is the one that sounds true. Say what you have already changed so it does not happen again. Do not ask them to keep it quiet, which never works and turns a mistake into something that looks like a cover up. Do it by phone or in person from someone senior, not as a group announcement. That sequence is not legal strategy, it is just the outcomes list the regulator would arrive at, done early.

Take down every copy you control, immediately, and do it before you reply rather than after. That means the post, any story or reshare from your own accounts, the website page and any newsletter that has not gone out. Be honest with the family about the limit: anything already downloaded, screenshotted or reshared by someone else is outside your reach, and promising a clean sweep you cannot deliver makes the next conversation worse. Keeping the original file is fine and often sensible, since you may need to show what was published.

Probably, and it catches people out. The regulator lists organisations covered regardless of turnover, and a health service provider is first on that list. Its separate page on what that means says the Act covers you even as a small business and even if health is not your main activity, and its examples end with "a private school or a childcare centre". Most services hold health information the moment they hold an allergy plan or an incident record. Government schools are the exception, sitting under state privacy law instead of the Commonwealth Act. The links are in the posting guide.

Usually not about this specific family, whose situation is theirs and not a community update. What is often worth sending is the change: a short note saying you have reviewed how photos are checked before posting and what the new step is. That reaches the people who were quietly wondering, without putting one family's business in front of forty households. If the incident is already widely known, acknowledge it in general terms and say what you have changed, rather than pretending it did not happen.

Legally, a determination telling you to apologise, change your procedures, train your staff and possibly pay compensation for non-financial loss. That is genuinely unpleasant and it is survivable, and it takes months of the matter not being dealt with to get there. The worse outcome is not legal at all: a family that leaves, tells forty other families why, and an image that is already copied and cannot be recalled. Which is why the useful response to this question is not reassurance, it is to go and check what is currently published against what families actually agreed to.