78Disclosure and use of information—other entities

78  Disclosure and use of information—other entities

 (1) The Board or the CEO may disclose information (not including personal information) to an entity covered by subsection (2) only if:

 (a) the Board or the CEO (as applicable) is satisfied that the disclosure is reasonably necessary to assist the Authority to perform a function mentioned in paragraph 16(1)(a) or (b); and

 (b) an arrangement between the Board and the entity is in force under subsection (4) of this section; and

 (c) the arrangement permits the disclosure of the information to the entity.

 (2) The following entities are covered by this subsection if the entity is not an entrusted entity or an individual who holds an office or appointment under a law of the Commonwealth or of a State or Territory:

 (a) an individual;

 (b) a body corporate;

 (c) a trust;

 (d) a corporation sole;

 (e) a body politic;

 (f) a local governing body.

 (3) Information disclosed to an entity in accordance with subsection (1) may be used by the entity only if:

 (a) the use is for the purposes of assisting the Authority to perform a function mentioned in paragraph 16(1)(a) or (b); and

 (b) an arrangement between the Board and the entity is in force under subsection (4) of this section; and

 (c) the arrangement permits the use of the information by the entity.

 (4) For the purposes of subsections (1) and (3), the Board may make an arrangement, in writing, with an entity relating to the disclosure of information to, and the use of information by, the entity.

Note: Subsection (1) does not authorise the disclosure of information, and subsection (3) does not authorise the use of that information, unless an arrangement is in force under this subsection authorising the disclosure and use of the information (see paragraphs (1)(b) and (3)(b)).

 (5) Before making an arrangement with an entity under subsection (4), the Board must have regard to the following:

 (a) the purposes for which the entity will or may use the information;

 (b) whether the entity has appropriate arrangements in place relating to the access to, and storage of, information that may be disclosed to the entity by the Board or the CEO;

 (c) whether the disclosure of information to the entity (whether generally or in specified circumstances) would be likely to result in harm to a person to whom the information relates;

 (d) if disclosure would be likely to result in harm as mentioned in paragraph (c)—whether provision could be included in the arrangement to appropriately manage that risk of harm.