59RCollecting, using and disclosing information for notification

#### 59R Collecting, using and disclosing information for notification 59R Collecting, using and disclosing information for notification > > (1) A public sector agency the subject of an eligible data breach may do the following— > > > > > (a) use relevant personal information, > > > > > (b) collect relevant personal information from another public sector agency, > > > > > (c) disclose relevant personal information to another public sector agency. > > > (2) Also, a public sector agency may disclose relevant personal information to a public sector agency the subject of an eligible data breach. > > > (3) Information may be collected, used or disclosed under this section only if it is reasonably necessary for the purpose of confirming— > > > > > (a) the name and contact details of a notifiable individual, or > > > > > (b) whether a notifiable individual is deceased. > > > (4) A public sector agency is not required to comply with an information protection principle, a Health Privacy Principle, a privacy code of practice or a health privacy code of practice in relation to the use, collection or disclosure of relevant personal information in accordance with subsection (1) or (2). > > > (5) In this section, a reference to an eligible data breach extends to a suspected breach within the meaning of section 59Y(1), if the Privacy Commissioner makes a recommendation under the section. > > > (6) This section applies despite any other provision of this Act. > > > (7) In this section— > > > > identifier means an identifier, not being an identifier that consists only of the individual’s name, which is usually, but need not be, a number, that is— > > > > > (a) assigned to an individual in conjunction with or in relation to the individual’s personal information by an organisation for the purpose of uniquely identifying that individual, whether or not it is subsequently used other than in conjunction with or in relation to personal information, or > > > > > (b) adopted, used or disclosed in conjunction with or in relation to the individual’s personal information by an organisation for the purpose of uniquely identifying the individual. > > > > notifiable individual— > > > > > (a) means an individual specified in section 59N(1), and > > > > > (b) includes a notifiable individual within the meaning of section 59Y. > > > > relevant personal information means the following— > > > > > (a) the name of an individual, > > > > > (b) the contact details of the individual, > > > > > (c) the date of birth of the individual, > > > > > (d) an identifier for the individual, > > > > > (e) if the individual is deceased—the date of death of the individual. > > **s 59R:** Ins 2022 No 74, Sch 1\[11\].