Document ID: chunk:federal_register_of_legislation:F2017L00298:body:0:p20
Version: federal_register_of_legislation:F2017L00298
Segment Type: other
Provision Reference: 
Character Range: 48697–51383

authorisation, in relation to the handling of any personal information.
 (6) If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with subsection (5) as if:
 (a) the member were a research entity; and
 (b) the duration of the research authorisation were the period during which the member has access to the customer data.
Note: Subsection (6) ensures that the Privacy Act 1988 applies to the member, for at least the period during which the member has access to the customer data, in relation to the handling of any personal information.

Use and security of customer data
 (7) The research entity:
 (a) must not use the customer data for any purpose other than conducting research of a kind to which the research authorisation applies; and
 (b) must not add other information to the customer data without the express consent of the person to whom the information relates; and
 (c) must make the customer data secure so that only its personnel and (if it is a research representative body) its members have access to the customer data for the purposes of conducting the research.
 (8) If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that:
 (a) the member must comply with paragraphs (7)(a) and (b) as if it were a research entity; and
 (b) the member must make the customer data secure so that only its personnel have access to the customer data for the purposes of conducting the research.

Contacting customers
 (9) If the research entity contacts a customer, using the customer data, for the purposes of conducting the research, the entity must:
 (a) tell the customer:
 (i) the name of the person or organisation conducting the research; and
 (ii) the contact details of the person or organisation, if requested by the customer; and
 (iii) the purpose of the research; and
 (iv) that the person or organisation has collected the customer data relating to the customer and, if requested by the customer, the circumstances of that collection; and
 (v) how the person or organisation proposes to use the customer data and any other information relating to the customer in the research; and
 (vi) how the customer can access the personal information about the customer held by the person or organisation, if requested by the customer; and
 (b) ask the customer if the customer gives consent:
 (i) for the use of the customer data and any other information relating to the customer in the research; and
 (ii) to having the