Document ID: chunk:federal_register_of_legislation:F2021L00231:clause:1_19a
Version: federal_register_of_legislation:F2021L00231
Segment Type: clause
Provision Reference: sch 1 cl 19A
Character Range: 36105–38479

19A  Additional requirement: retention and disposal
(1)    A Research Organisation must retain identifiable research information only while the details of the identity of the individual whom the information is about continue to be necessary to be retained for research purposes. The information must be destroyed or de-identified once these purposes have been achieved. Where identifiable research information has been returned to a third party (in accordance with APP6) any copies, including archived copies, must be destroyed or de-identified.
(2)    If a Research Organisation wishes to de-identify identifiable research information that exists in a physical form that makes de-identification impracticable (e.g. on paper), the information must be moved to another medium, de-identified, and the physical records then destroyed.
(3)    Where it is necessary to retain identifiable research information, identifying (contact) details must, if practicable, be stored separately from other information (research status and research data), with measures in place (e.g. by the use of an encrypted intervening variable) to ensure the identity of the individuals cannot be readily revealed from the other information.
(4)    A Research Organisation must take reasonable steps to ensure that any identifiable research information that it discloses:
         (a)    will only be retained, used or disclosed by the recipient of the information in a manner that is consistent with this Code; and
         (b)    will be protected by the recipient from misuse, interference and loss and from unauthorised access, modification, use and disclosure; and
         (c)    will only be used or disclosed by the recipient for a specified limited purpose and will be destroyed or de-identified once this purpose has been achieved. Where identifiable research information has been returned by the recipient to a third party (in accordance with APP6) any copies, including archived copies, must by destroyed or de-identified.
(5)    A Research Organisation may disclose de-identified information freely, provided that there is no reasonable likelihood that the disclosed information could be used to identify one or more of the individuals who participated in the research, such as where the pattern of answers could reveal their identity.

Access to, and correction of, personal information