18. (1) A complaint may be made to the Commissioner about an act or omission that is alleged to contravene the Privacy Principles in relation to a consumer.
(2) In the case of a complaint about an act or omission that is alleged to contravene the Privacy Principles in relation to a deceased consumer, it is immaterial whether the contravention occurred, or is alleged to have occurred, in the lifetime or after the death of the deceased consumer.
(3) A complaint may be made to the Commissioner to review an act or omission that is alleged to constitute a refusal to give access in accordance with this Act to a health record relating to a consumer.
(4) A request may be made to the Commissioner to review a claim by a record-keeper in respect of a health record that there is—
(a) a ground under section 14 for non-production of the health record; or
(b) a ground under section 15 or 17 on which the record-keeper is prohibited from giving access to the health record.
(5) A complaint or request to review may be made by—
(a) unless paragraph (b) applies—the consumer;
(b) if the consumer is a young person or a legally incompetent person—the guardian of the consumer;
(c) if the complaint or request concerns a health record relating to a deceased consumer—the legal representative of the deceased consumer; or
(d) a person approved by the Commissioner to make the complaint or request on the consumer's behalf.