7Project principle—applicable processes relating to ethics

7 Project principle—applicable processes relating to ethics

(1) As part of satisfying itself that a project is consistent with the project principle set out in subsection 16(1) of the Act, including the element set out in paragraph 16(2)(b) of the Act, an entity must: (a) consider what processes of ethics (if any) are applicable to all or part of the project, whether as a matter of law or policy; and (b) if observance of an applicable process is mandatory, whether as a matter of law or policy—observe that process.

Note 1: Ethics processes involve the review of the ethical risks of sharing, collecting and using data, using an established method that is appropriate in view of the individuals, entities or subject matter to which the data relates. Ethics processes may be applicable to a project even if the data to be shared, collected and used does not directly relate to individuals (it may, for example, relate to the environment). Ethics processes may include an assessment of the potential harm of the outcomes of the project to individuals, society or the economy. They may be mandated by policy frameworks within an entity that is a data custodian or accredited entity, or by an independent body such as the National Health and Medical Research Council or the Australian Institute of Aboriginal and Torres Strait Islander Studies.

Note 2: If paragraph (b) applies, the data sharing agreement should specify the actions the entity will take to observe the process (see subsection 19(7) of the Act).

(2) However, if observance of more than one applicable process is mandatory in relation to the project, or the same part of the project, the requirement in paragraph (1)(b) that the entity observe any mandatory applicable process is satisfied as long as: (a) the entity observes at least one of those processes; and (b) the process to be observed is chosen by agreement between the data custodian, the accredited user and any ADSP.

Note: This subsection means that, for the purposes of the data sharing scheme, entities need not observe more than one applicable ethics process if more than one such process is mandatory. However, being relieved of this duty for the purposes of the data sharing scheme does not affect an entity’s duty to observe mandatory ethics processes for other purposes.

(3) The project principle does not require entities to observe any ethics processes additional to those otherwise applicable. It also does not prevent entities from observing additional ethics processes if they wish.