126Data codes

126 Data codes

(1) The Commissioner may, by legislative instrument, make codes of practice about the data sharing scheme (data codes). (2) Without limiting what a data code may do, it may do any of the following: (a) set out how the definitions in sections 9, 10, 11 and 11A, and provisions of Chapters 2 and 3, are to be applied or complied with; (b) impose additional requirements to those imposed by Chapters 2 and 3, so long as the additional requirements are not contrary to, or inconsistent with, those Chapters; (c) deal with the internal handling of complaints; (d) deal with the management of complaints under Part 5.3 and impose additional requirements to those set out in that Part, so long as the additional requirements are not contrary to, or inconsistent with, that Part; (e) deal with any other matters the Commissioner considers necessary or convenient to deal with for carrying out or giving effect to the data sharing scheme. (2A) The Commissioner must make one or more data codes about: (a) the data sharing principles in section 16; and (b) the general privacy protections in section 16A; and (c) the purpose‑specific privacy protections in section 16B. (2B) A data code about the general privacy protections in section 16A must deal with consent by individuals to the sharing of their personal information. (2C) A data code about the purpose‑specific privacy protections in section 16B must deal with the following: (a) consent by individuals to the sharing and use of their personal information and circumstances in which it is unreasonable or impracticable to seek individuals’ consent; (b) principles to be applied by data custodians when determining: (i) whether it is necessary to share personal information to properly deliver a government service; or (ii) the circumstances, or categories of circumstances, where the public interest to be served by a project justifies the sharing of personal information without consent. (3) A data code that is inconsistent with the regulations or rules has no effect to the extent of the inconsistency, but a data code is taken to be consistent with the regulations and rules to the extent that the data code is capable of operating concurrently with them.