18Consent to provision of access to or release of personal information—paragraph 20C(1)(b) of the Act

18 Consent to provision of access to or release of personal information—paragraph 20C(1)(b) of the Act

(1) A data sharing agreement may allow the accredited user to provide another entity with access to output of a project, or to release it, if the agreement meets all of the conditions specified in subsection 20C(1) of the Act. One of the conditions is that the agreement must prohibit provision of access to or release of personal information about an individual unless the individual consents (paragraph 20C(1)(b) of the Act). This section is about the individual’s consent. (2) Before the consent is given, the individual must be adequately informed about the provision of access to or the release of the personal information, including the following: (a) the nature of the personal information; (b) for provision of access—the entity or entities to which access will be provided. (3) The consent must be voluntary. (4) The consent must relate specifically to the provision of access or the release. (5) The consent must be current at the time of the provision of access or the release. (6) Without limiting subsection (5), consent is not current at the time of the provision of access or the release if the consent was withdrawn before that time. (7) A withdrawal of consent has effect only if done expressly (whether orally or in writing), and before the time of the provision of access or the release. A withdrawal of consent has no effect in relation to a provision of access or release that occurred before the withdrawal. (8) The consent must be given: (a) if the individual has the capacity to consent—by the individual; or (b) otherwise—by a responsible person for the individual (within the meaning of the Privacy Act 1988). (9) Consent for the purposes of a provision of a data sharing agreement included for the purposes of paragraph 20C(1)(b) of the Act may be express (either oral or in writing) or implied (in circumstances where it may be reasonably inferred from conduct).