19Consent to exit of personal information—paragraph 20E(4)(c) of the Act

19 Consent to exit of personal information—paragraph 20E(4)(c) of the Act

(1) Output of a project can exit the data sharing scheme in some circumstances (meaning that the requirements of the Act no longer apply to its use). Subsection 20E(4) sets out circumstances in which personal information about an individual that the accredited user holds can exit. In particular, paragraph 20E(4)(c) requires that the individual must have expressly consented to their personal information being both: (a) shared by the data custodian with the accredited user; and (b) used by the accredited user without the requirements of the Act applying to the use. This section is about the individual’s consent. (2) Before the consent is given, the individual must be adequately informed about the sharing, including the following: (a) the nature of the personal information to be shared; (b) whether the personal information is to be shared more than once; (c) the accredited entity or entities with which the information will be shared. (3) Before the consent is given, the individual must be adequately informed that: (a) the personal information will be shared under the Act; and (b) generally, the use of personal information and other data shared under the Act is limited by the Act; and (c) if the individual gives the consent sought, the Act will not limit the use of the personal information by the accredited user. (4) The individual may be informed about other laws that will limit the use and disclosure of the personal information by the accredited user, if the individual gives the consent sought. (5) The consent may be sought by the data custodian or by the accredited user. (6) The consent must be voluntary. (7) The consent must relate specifically to the sharing of the personal information with the accredited user and the accredited user’s use of the personal information. (8) The consent must be current at the time of the sharing. (9) Without limiting subsection (8), consent is not current at the time of the sharing if the consent was withdrawn before that time. (10) A withdrawal of consent has effect only if done expressly (whether orally or in writing) and only in relation to sharing after the time of the withdrawal. A withdrawal of consent has no effect in relation to sharing that occurred before the withdrawal. (11) The consent must be given: (a) if the individual has the capacity to consent—by the individual; or (b) otherwise—by a responsible person for the individual (within the meaning of the Privacy Act 1988).