45Meaning of *information usage arrangement*

45 Meaning of *information usage arrangement* (1) In this Division, an ***information usage arrangement*** is an arrangement that— (a) sets out acts or practices for handling personal information to be undertaken in relation to one or more public purposes; and (b) for any of those acts or practices, does any one or more of the following— (i) modifies the application of a specified Information Privacy Principle (other than IPP 4 or 6) or an approved code of practice; (ii) provides that the practice does not need to comply with a specified Information Privacy Principle (other than IPP 4 or 6) or an approved code of practice; (iii) permits handling personal information for the purposes of an information handling provision. (2) An information usage arrangement must— (a) specify the parties to the arrangement; and **Note** See section 46 as to who can be a party to an information usage arrangement. (b) specify the personal information or type of personal information to be handled under the arrangement; and (c) describe how the arrangement would facilitate one or more public purposes; and (d) if handling personal information under the arrangement modifies or provides for noncompliance with an Information Privacy Principle or an approved code of practice— (i) identify the Information Privacy Principle or approved code of practice; and (ii) state how the Information Privacy Principle or approved code of practice would be modified or not complied with; and (e) if the arrangement would be for the purposes of an information handling provision— (i) identify the provision; and (ii) describe the effect of the provision; and (f) for every party to the arrangement— (i) describe the personal information or type of personal information that the party could disclose or transfer to other parties to the arrangement; and (ii) state the manner in which a party could use personal information, including whether a party could disclose that information to another person or body and in what circumstances; and (g) for every organisation that is a party to the arrangement— (i) state adverse actions that an organisation could reasonably be expected to take as a result of handling personal information under the arrangement; and (ii) specify the procedure that an organisation must follow before taking adverse action as a result of handling of personal information under the arrangement. (3) An information usage arrangement may include an expiry date. However, if an information usage arrangement does not do so, it must include the reason why it does not do so.