16BPurpose‑specific privacy protections

16B Purpose‑specific privacy protections

If data sharing purpose is delivery of government services (1) If the data sharing purpose of the project is delivery of government services, the data must not include personal information about an individual unless: (a) one or more of the following apply: (i) the service being delivered is a service mentioned in paragraph 15(1A)(a) or (b) and is delivered to the individual; (ii) the individual consents to the sharing of their personal information; (iii) the sharing would be a disclosure authorised under Part VIA of the Privacy Act 1988 (dealing with personal information in emergencies and disasters); and (b) the service being delivered is identified in the data sharing agreement for the project; and (c) only the minimum amount of personal information necessary to properly deliver the service is shared. (2) If data that includes personal information is to be shared with an accredited user in circumstances in which the shared data exits the data sharing scheme under subsection 20E(4), the data sharing agreement must specify this. If data sharing purpose is informing government policy and programs or research and development (3) If the data sharing purpose of the project is informing government policy and programs, or research and development, the data must not include personal information about an individual unless: (a) both of the following apply: (i) the individual consents to the sharing of their personal information; (ii) only the minimum amount of personal information necessary for the project to proceed is shared; or (b) all of the following apply: (i) the project cannot proceed without the personal information; (ii) the public interest served by the project justifies the sharing of personal information about individuals without their consent; (iii) only the minimum amount of personal information necessary for the project to proceed is shared; (iv) a permitted circumstance for the project’s data sharing purpose exists (see subsections (4) and (5)). (4) The permitted circumstances for the data sharing purpose of informing government policy and programs are the following: (a) it is unreasonable or impracticable to seek the individual’s consent; (b) the data is to be collected and used in the course of medical research and in accordance with guidelines under subsection 95(1) of the Privacy Act 1988; (c) the sharing is with an ADSP as an intermediary, to enable the ADSP to prepare ADSP‑enhanced data that does not involve personal information about the individual; (d) the sharing is ADSP‑controlled access (see subsection (6)); (e) the accredited user is a Commonwealth body (other than a Commonwealth body excluded from this paragraph by the rules) and the final output of the project includes only de‑identified information; (f) the sharing is a disclosure authorised under Part VIA of the Privacy Act 1988 (dealing with personal information in emergencies and disasters).