Exception to restriction on disclosure by prescribed entity
 6. (1) Despite subsection 293 (9) of the Act, a prescribed entity, or a person or entity that is not a prescribed entity, may disclose personal information disclosed to it under subsection 293 (1), (2) or (3) of the Act to, (a) another prescribed entity, if the disclosure is for the purposes described in subsection 293 (1) of the Act; or (b) a researcher, in the circumstances set out in subsection (2). (2) A prescribed entity, or a person or entity that is not a prescribed entity, may disclose personal information disclosed to it under subsection 293 (1), (2) or (3) of the Act to a researcher if, (a) the researcher demonstrates that, (i) the researcher has prepared a research plan relating to the personal information to be disclosed that meets the requirements of subsection 4 (2) and has had the plan approved by a research ethics board that meets the criteria set out in paragraph 1 of subsection 4 (1), (ii) in considering the research plan, the research ethics board considered, (A) whether the objectives of the research could reasonably be accomplished without using the personal information, (B) whether, at the time the research is to be performed, adequate safeguards will be in place to protect the privacy of individuals whose personal information will be used in the research and to preserve the confidentiality of the information, (C) the public interest in conducting the research and the public interest in protecting the privacy of individuals to whom the personal information relates, and (D) whether obtaining the consent of the individuals to whom the personal information relates would be impractical; (b) the researcher has entered into an agreement with the prescribed entity, or person or entity that is not a prescribed entity, that requires the researcher to comply with any recommendations of the research ethics board respecting the performance of the research as set out in the board’s approval of the researcher’s research plan; and (c) the prescribed entity, or person or entity that is not a prescribed entity, is satisfied that the researcher will, (i) comply with the agreement described in clause (b), (ii) use the information only for the purposes set out in the research plan approved by the research ethics board, (iii) not publish the information in a form that could reasonably enable a person to ascertain the identity of the individual, (iv) not disclose any personal information disclosed to the researcher except as required by law, (v) not make contact, or attempt to make contact, directly or indirectly, with any individual whose personal information has been disclosed to the researcher, and (vi) notify the prescribed entity, or the person or entity that is not a prescribed entity, immediately in writing if the researcher fails to do anything described in this clause. (3) A prescribed entity, or person or entity that is not a prescribed entity, who is notified by a researcher to whom the person or entity has disclosed personal information under clause (1) (b) that the researcher has failed to do something described in clause (2) (c) shall immediately notify the Commissioner if the notification relates to the theft, loss or unauthorized use or disclosure of personal information.