28Capacity to consent or make a request or exercise right of access

28 Capacity to consent or make a request or exercise right of access

(1) If an Information Privacy Principle or an applicable code of practice requires the consent of an individual to the collection, holding, management, use or disclosure of personal information or to the transfer of personal information to someone who is outside Victoria, an authorised representative of the individual may give that consent if—

(a) the individual is incapable of giving consent; and

(b) the consent is reasonably necessary for the lawful performance of functions or duties or exercise of powers in respect of the individual by the authorised representative.

(2) If an Information Privacy Principle or an applicable code of practice empowers an individual to request access to, or the correction of, personal information or confers on an individual a right of access to personal information, the power to make that request, or that right of access, may be exercised—

S. 28(2)(a) substituted by No. 64/2016 s. 16.

(a) by—

(i) the individual personally, except if the individual is a child who is incapable of making the request; or

S. 28(2)(a)(ii) amended by No. 13/2019 s. 221(Sch. 1 item 39.1).

(ii) a supportive attorney acting under a supportive attorney appointment, within the meaning of the Powers of Attorney Act 2014; or

S. 28(2)(a)(iii) inserted by No. 13/2019 s. 221(Sch. 1 item 39.2).

(iii) a supportive administrator acting under a supportive administration order within the meaning of the Guardianship and Administration Act 2019; or

S. 28(2)(a)(iv) inserted by No. 13/2019 s. 221(Sch. 1 item 39.2).

(iv) a supportive guardian acting under a supportive guardianship order within the meaning of the Guardianship and Administration Act 2019; and

(b) by an authorised representative of the individual if—

(i) the individual is incapable of making the request or exercising the right of access; and

(ii) the personal information to be accessed is reasonably necessary for the lawful performance of functions or duties or exercise of powers in respect of the individual by the authorised representative.

(3) For the purposes of subsections (1) and (2), an individual is incapable of giving consent, making the request or exercising the right of access if the individual is incapable (despite the provision of reasonable assistance by another individual) by reason of age, injury, disease, senility, illness, disability, physical impairment or mental disorder of—

(a) understanding the general nature and effect of giving the consent, making the request or exercising the right of access (as the case requires); or