Document ID: chunk:federal_register_of_legislation:F2021L00231:clause:1_16
Version: federal_register_of_legislation:F2021L00231
Segment Type: clause
Provision Reference: sch 1 cl 16
Character Range: 28841–31336

16  Australian Privacy Principle 8: Cross-border disclosure of personal information (as customised for the purposes of this Code)
       (1)    Before a Research Organisation discloses identifiable research information about an individual to a person (the overseas recipient):
         (a)    who is not in Australia or an external Territory, and
         (b)    who is not the Research Organisation itself or the individual,

         the Research Organisation must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the information.

            Note: In certain circumstances, an act done, or a practice engaged in, by the overseas recipient is taken, under section 16C, to have been done, or engaged in, by the APP entity and to be a breach of the Australian Privacy Principles.

        (2) Subsection 16(1) does not apply to the disclosure of identifiable research information about an individual by a Research Organisation to the overseas recipient if:

           (a)             the Research Organisation reasonably believes that:

              (i)            the recipient of the information is subject to a law, or binding scheme, that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way in which the Australian Privacy Principles protect the information; and

              (ii)            there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme; or

           (b)            both of the following apply:

              (i)            the Research Organisation expressly informs the individual that if he or she consents to the disclosure of the information, subsection 16(1) will not apply to the disclosure;

              (ii)            after being so informed, the individual consents to the disclosure; or

           (c)             the disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or

           (d)            a permitted general situation (other than the situation referred to in item 4 or 5 of the table in subsection 16A(1) of the Privacy Act) exists in relation to the disclosure of the information by the Research Organisation.

            Note: For permitted general situations, see section 16A of the Privacy Act.