Document ID: chunk:federal_register_of_legislation:F2016L00360:reg:14:p9
Version: federal_register_of_legislation:F2016L00360
Segment Type: reg
Provision Reference: reg 14 (pt 9/16)
Character Range: 23116–26253

of the Privacy Act. The Commissioner will generally publish the name of the respondent. However, the Commissioner will generally not publish the names of complainants, respondent individuals or any third party individuals.
Part 3 Use of enforcement powers under the My Health Records Act and Privacy Act
8 Enforceable undertakings under the My Health Records Act

  Legislative basis for accepting undertakings
8.1  Under section 80 of the My Health Records Act, the Information Commissioner may accept a written undertaking in relation to the My Health Records Act given by a person that the person will:
           a)      take specified action in order to comply with the My Health Records Act;
           b)     refrain from taking specified action, in order to comply with the My Health Records Act; or
           c)      take specified action directed towards ensuring that the person does not contravene the My Health Records Act, or is unlikely to contravene the My Health Records Act, in the future.
      8.2   Section 80 of the My Health Records Act triggers the provisions of Part 6 of the Regulatory Powers Act which deals with the acceptance and enforcement of undertakings relating to compliance with legislative provisions.

  Giving an enforceable undertaking

 8.3   The individual giving and executing the undertaking must have the authority to negotiate on behalf of, and bind, the respondent person.

  Terms of an undertaking
8.4  To be acceptable to the Information Commissioner, the terms of an enforceable undertaking should:
           a)      describe the alleged contravention(s) about which the Information Commissioner is concerned;
           b)     outline specified steps the person will take to rectify the contravention, and ensure that it is not repeated or continued. This will usually include a requirement for the person to complete reviews and establish a monitoring and reporting framework;
           c)      contain dates by which the person is required to complete each step;
           d)     be capable of implementation and include action which is capable of being measured or tested objectively;
           e)      be certain and capable of enforcement.
8.5   The Information Commissioner will not accept an enforceable undertaking that:
           a)      denies responsibility for an alleged contravention of the My Health Records Act or Privacy Act;
           b)     merely undertakes to comply with the law without explaining how compliance will be achieved;
           c)      seeks to impose terms or conditions on the Information Commissioner.

  General approach to accepting undertakings
8.6  When deciding whether to accept an undertaking, the Information Commissioner may take into account:
           a)      the particular circumstances of the matter;
           b)     the factors referred to at section 7.1 of these guidelines;
           c)      whether the Information Commissioner believes that the respondent has the ability to, and genuinely intends to, comply with the terms of the undertaking.
  Withdrawing, varying or cancelling an undertaking accepted by the