28Capacity to consent or make a request or exercise right of access

28 Capacity to consent or make a request or exercise right of access (1) If an Information Privacy Principle or an applicable code of practice requires the consent of an individual to the collection, holding, management, use or disclosure of personal information or to the transfer of personal information to someone who is outside Victoria, an authorised representative of the individual may give that consent if— (a) the individual is incapable of giving consent; and (b) the consent is reasonably necessary for the lawful performance of functions or duties or exercise of powers in respect of the individual by the authorised representative. (2) If an Information Privacy Principle or an applicable code of practice empowers an individual to request access to, or the correction of, personal information or confers on an individual a right of access to personal information, the power to make that request, or that right of access, may be exercised— S. 28(2)(a) substituted by No. 64/2016 s. 16. (a) by— (i) the individual personally, except if the individual is a child who is incapable of making the request; or S. 28(2)(a)(ii) amended by No. 13/2019 s. 221(Sch. 1 item 39.1). (ii) a supportive attorney acting under a supportive attorney appointment, within the meaning of the **Powers of Attorney Act 2014**; or S. 28(2)(a)(iii) inserted by No. 13/2019 s. 221(Sch. 1 item 39.2). (iii) a supportive administrator acting under a supportive administration order within the meaning of the **Guardianship and Administration Act 2019**; or S. 28(2)(a)(iv) inserted by No. 13/2019 s. 221(Sch. 1 item 39.2). (iv) a supportive guardian acting under a supportive guardianship order within the meaning of the **Guardianship and Administration Act 2019**; and (b) by an authorised representative of the individual if— (i) the individual is incapable of making the request or exercising the right of access; and (ii) the personal information to be accessed is reasonably necessary for the lawful performance of functions or duties or exercise of powers in respect of the individual by the authorised representative. (3) For the purposes of subsections (1) and (2), an individual is incapable of giving consent, making the request or exercising the right of access if the individual is incapable (despite the provision of reasonable assistance by another individual) by reason of age, injury, disease, senility, illness, disability, physical impairment or mental disorder of— (a) understanding the general nature and effect of giving the consent, making the request or exercising the right of access (as the case requires); or (b) communicating the consent or refusal of consent, making the request or personally exercising the right of access (as the case requires). (4) An authorised representative of an individual must not give consent or request access to, or the correction of, personal information if the authorised representative knows or believes that the consent or request does not accord with the wishes expressed, and not changed or withdrawn, by the individual before the individual became incapable of giving consent or requesting access and any purported consent given or request made in those circumstances is of no effect. (5) An organisation may refuse a request by an authorised representative of an individual for access to the personal information of the individual if the organisation reasonably believes that access by the authorised representative may endanger the individual. (6) In this section— S. 28(6) def. of *authorised representative* amended by Nos 69/2016 s. 158, 13/2019 s. 221(Sch. 1 item 39.3). ***authorised representative***, in relation to an individual— (a) means a person who is— (i) a guardian of the individual; or (ii) an attorney for the individual under an enduring power of attorney; or (iii) a medical treatment decision maker for the individual within the meaning of the **Medical Treatment Planning and Decisions Act 2016**; or (iiia) a support person for the individual within the meaning of the **Medical Treatment Planning and Decisions Act 2016**; or (iv) an administrator within the meaning of the **Guardianship and Administration Act 2019**; or (v) a parent of an individual, if the individual is a child; or (vi) otherwise empowered under law to perform any functions or duties or exercise powers as an agent of or in the best interests of the individual; and (b) does not include a person acting as an authorised representative of the individual if that acting is inconsistent with an order made by a court or tribunal; ***disability*** has the same meaning as in the **Disability Act 2006**. Division 5—Public interest determinations and temporary public interest determinations Subdivision 1—Public interest determinations 29 Public interest determination S. 29(1) amended by No. 20/2017 s. 106(2). (1) An organisation may apply to the Information Commissioner, in writing, for a determination that— (a) an act or a practice of an organisation contravenes or may contravene a specified Information Privacy Principle (other than IPP 4 or 6) or an approved code of practice; and (b) the public interest in the organisation doing the act or engaging in the practice substantially outweighs the public interest in complying with that Information Privacy Principle or approved code of practice. (2) The application for a public interest determination must specify— (a) the act or practice to which the determination would apply; and (b) the relevant Information Privacy Principle or approved code of practice; and (c) the reasons for the organisation seeking the determination. (3) A public interest determination must not be made in respect of IPP 4 or 6. S. 29(4) amended by No. 20/2017 s. 106(2). (4) On receipt of the application, the Information Commissioner must publish, as the Information Commissioner thinks fit, a notice— (a) stating that the application has been received; and (b) inviting persons whose interests would be affected by the determination to make submissions in relation to the application; and (c) stating a time period for making submissions in relation to the application. S. 29(5) amended by No. 20/2017 s. 106(2). (5) The Information Commissioner must prepare a draft determination and send a copy to the applicant and each person who has made a submission under subsection (4). S. 29(6) amended by No. 20/2017 s. 106(2). (6) The Information Commissioner may invite the applicant and any person who has made a submission under subsection (4) to attend a conference about the draft determination.