Document ID: chunk:federal_register_of_legislation:F2021L00231:clause:1_21a:p3
Version: federal_register_of_legislation:F2021L00231
Segment Type: clause
Provision Reference: sch 1 cl 21A (pt 3/5)
Character Range: 51533–54584

with this code or if the Code Administrator becomes aware of systemic issues that would justify a review.
       (4)    The terms of reference for each review will be drawn up by the Code Administrator in consultation with the Privacy Compliance Committee.
       (5)    Each review will be funded by AMSRO in such manner as the AMSRO Board considers appropriate, having regard to the resource requirements necessary for the effective execution of the review.
       (6)    Reports of the independent code review will include recommendations for any amendments to this Code that are considered necessary or desirable for the effective operation of this Code.

25 Consultation
       In conducting an independent review, the Code Administrator will notify the Commissioner of the review; and the Independent Code Reviewer will seek the views of the Commissioner, government agencies, industry representatives, consumer representatives, the general public and other persons or bodies as appropriate in Australia and internationally; regarding the operation of this Code and in relation to suitable revisions and amendments.

26 Reporting following an Independent Code Review
       (1)    The report of the Independent Code Reviewer shall be made publicly available online and shall outline the issues raised by the review and the findings of the review.
       (2)    The report shall be accompanied by a response from the Code Administrator, outlining the actions taken, or that will be taken, by the Code Administrator and/or the research organisations bound by this Code to address issues identified by the review.

27 Variation of the Code
       (1)    Following a recommendation of an Independent Code Review, or for any other reason, the Code Administrator may apply to the Commissioner for variation of the Code.
       (2)    Any such application would follow the process set out in the Act and guidance issued by the Commissioner.

Part 5—Monitoring and reporting

28 Monitoring and reporting
       (1)    Research Organisations must report annually, by 31 August, to the Code Administrator, on the number, nature and outcomes of any complaints received about Breaches of this Code.
       (2)    Research Organisations must report systemic issues in relation to their compliance with this Code, or serious and repeated Breaches of this Code, to the Commissioner as soon as they become aware of them.
       (3)    Research Organisations must notify eligible data breaches to the Australian Information Commissioner and otherwise comply with the eligible data breach requirements of the Privacy Act. Research Organisations should also inform the Code Administrator of any notification of an eligible data breach as provided to the Australian Information Commissioner and of any reasonably likely or actual serious data breach (whether or not a notifiable eligible data breach) that demonstrates a significant vulnerability of other Research Organisations in handling of identifiable research information that might reasonably be expected to