Document ID: chunk:federal_register_of_legislation:F2024L00982:clause:1_3:p1
Version: federal_register_of_legislation:F2024L00982
Segment Type: clause
Provision Reference: sch 1 cl 3 (pt 1/2)
Character Range: 36449–39407

3  Data sharing agreements—disclosure under subsection 11(7)

Data sharing agreement must deal with how disclosed claims information can be used
 (1) A data sharing agreement must:
 (a) specify the purpose for which the recipient may use the information disclosed under the agreement as use for medical research; and
 (b) not permit the recipient to use the information for other purposes.

Data sharing agreement must deal with re-identification of de‑identified claims information
 (2) A data sharing agreement must include a requirement that, if de‑identified claims information is disclosed to the recipient in accordance with the agreement, the recipient is not to re‑identify the information other than in accordance with the agreement.
 (3) A data sharing agreement must include a requirement that, if:
 (a) the recipient re‑identifies claims information, whether advertently or inadvertently; and
 (b) the re‑identification was not in accordance with the agreement;
the recipient must notify the disclosing agency of:
 (c) that fact; and
 (d) the steps the recipient has taken to:
 (i) either destroy the re‑identified information, or de‑identify it; and
 (ii) prevent further claims information being re‑identified.

Data sharing agreement must not permit disclosure of claims information
 (4) A data sharing agreement must not permit the recipient to on‑disclose claims information that was disclosed under the data sharing agreement.
Note: A data sharing agreement will not have the effect of preventing a recipient from disclosing information such as de-identified or aggregated information which was derived from, but no longer is, claims information.

Data sharing agreement must require compliance with Australian Privacy Principles in appropriate cases
 (5) A data sharing agreement must, if the recipient is not covered by the Privacy Act 1988 or a State or Territory privacy law, require the recipient to comply with the Australian Privacy Principles in relation to claims information that is personal information as if the recipient were an organisation (within the meaning of the Privacy Act 1988).

Data sharing agreement must deal with storage and security requirements
 (6) A data sharing agreement must:
 (a) specify the storage and, if the recipient is not an agency, security requirements that apply to the disclosed claims information; and
 (b) require the recipient to comply with those requirements.

Data sharing agreement must deal with disposal or destruction of claims information
 (7) A data sharing agreement must, if the recipient is not an agency, contain provisions which:
 (a) require the recipient of the disclosed information to dispose of or destroy the information by a date specified in the agreement; and
 (b) provide for the recipient to apply to the primary agency which disclosed the information for an extension of that date, in a form approved by the agency; and
 (c) permit the primary agency to extend that