21Organisation to comply with HPPs

21 Organisation to comply with HPPs (1) Subject to this section and section 20, an organisation must not do an act, or engage in a practice, that is an interference with the privacy of an individual. (2) Subsection (1) does not apply if the organisation proves that, in the circumstances, compliance with this Act or the Health Privacy Principle would have contravened another Act, regulations made under another Act or an order of a tribunal or of a court of competent jurisdiction. (3) Subsection (1) does not apply to the doing of an act, or the engaging in of a practice, by an organisation that, but for this subsection, would constitute a breach of HPP 1 or HPP 2, if— (a) the doing of the act or the engaging in of the practice is necessary for the performance of a contract to which the organisation is a party entered into by the organisation before 23 November 2000; and (b) the act is done or the practice is engaged in before the second anniversary of the commencement of section 20 or the end of any extension of that period granted in relation to that contract under subsection (4). S. 21(4) amended by No. 22/2016 s. 180(a). (4) On the application of an organisation before the second anniversary of the commencement of section 20 or before the expiry of any extension of that period granted under this subsection, the Health Complaints Commissioner may grant an extension of that period in relation to a specified contract if he or she is of the opinion that the organisation is doing its best— (a) to comply with HPP 1 or HPP 2 consistent with its obligations under the contract; and (b) to seek to have the contract re-negotiated to enable the organisation to comply fully with HPP 1 or HPP 2. (5) Subsection (1) does not apply to the doing of an act, or the engaging in of a practice, by an organisation that, but for this subsection, would constitute a breach of HPP 2, in relation to health information collected by the organisation before the commencement of section 20, if— S. 21(5)(a) amended by No. 22/2016 s. 180(b). (a) the Health Complaints Commissioner, on the application of the organisation, grants the organisation an exemption from that Principle in relation to specified information or information of a specified class for a specified period; and (b) the act is done or the practice is engaged in, in relation to information to which the exemption applies— (i) before the second anniversary of the commencement of section 20; and (ii) during the period specified in the exemption. S. 21(6) amended by No. 22/2016 s. 180(c). (6) The Health Complaints Commissioner may grant an exemption under subsection (5) if he or she is of the opinion that, in the particular circumstances, it is in the public interest for the use or disclosure to continue otherwise than in compliance with HPP 2. (7) Subsection (1) does not apply to the doing of an act, or the engaging in of a practice, by an organisation that, but for this subsection, would constitute a breach of HPP 2, in relation to health information collected by the organisation before the commencement of section 20, if the act is done, or the practice is engaged in, in the prescribed circumstances.