Conditions for Using Personal Information

In a seashell...

Section 6, Conditions for using personal information, states that:

(1) Subject to subsections (2), (3) and (4), an organisation may use an individual’s personal information only if one or more of the following conditions are met —

(a) the personal information is used with the consent of the individual where the organisation can reasonably demonstrate that the individual has knowingly consented;

(b) except in relation to sensitive personal information, a reasonable person giving due weight to the sensitivity of the personal information would consider—

(i) that the individual would not reasonably be expected to request that the use of his personal information should not begin or cease; and

(ii) that the use does not prejudice the rights of the individual;

(i) for the performance of a contract to which the individual is a party; or

(ii) for the taking of steps at the request of the individual with a view to entering into a contract;

(d) the use of the personal information is pursuant to a provision of law that authorises or requires such use;

(e) the personal information is publicly available information and will be used for a purpose that is consistent with the purpose of its public availability;

(f) the use of the personal information is necessary to respond to an emergency that threatens the life, health or security of an individual or the public;

(g) the use of the personal information is necessary to perform a task carried out in the public interest or in the exercise of official authority vested in the organisation or in a third party whom the personal information is disclosed; or

(h) the use of the personal information is necessary in the context of an individual’s present, past or potential employment relationship with the organisation.

(2) For the purpose of relying on consent as a condition for the use of personal information

under subsection (1)(a);

(a) an organisation shall provide clear, prominent, easily understandable, accessible mechanisms for an individual to give consent in relation to the use of his personal information;

(b) an organisation is not obliged to provide such mechanisms where it can be reasonably implied from the conduct of an individual that he consents to the use of his personal information for all intended purposes that have been notified to him, but this does not apply to sensitive personal information;

(c) when an individual consents to the disclosure of his personal information by an intermediary for a specified purpose, that individual will be deemed to have consented to the use of that personal information by the receiving organisation for the specified purpose;

(d) an individual will be deemed to have consented to the use of his personal information for the purpose of coverage or enrolment under an insurance, trust, benefit or similar plan if the individual has an interest in or derives a benefit from that plan.

(3) If an organisation is unable to meet any of the conditions of subsection (1), then it may use personal information only if—

(a) the personal information was collected from, or is disclosed to, a public authority which is authorised or required by a statutory provision to provide the personal information to, or collect it from, the organisation;

(b) the use of the personal information is for the purpose of complying with an order made by a court, individual or body having jurisdiction over the organisation;

(c) the use of the personal information is for the purpose of contacting the next of kin or a friend of an injured, ill or deceased individual;

(d) the use of the personal information is necessary in order to collect a debt owed to the organisation or for the organisation to repay to the individual money owed by the organisation;

(e) the use of the personal information is in connection with disclosure to the surviving spouse or a relative of a deceased individual if, in the reasonable opinion of the organisation, the disclosure is appropriate; or

(f) the use of the personal information is reasonable to protect or defend the organisation in any legal proceeding.

(4) Where an organisation transfers personal information to an overseas third party, in addition to complying with the obligations of subsections (1) to (3), the organisation must also meet the obligations under section 15.