Privacy Act 1988

PART IIIC - NOTIFICATION OF ELIGIBLE DATA BREACHES  

Division 5 - Dealing with personal information involved in eligible data breaches  

Subdivision B - Provisions dealing with the collection, use and disclosure of personal information  

SECTION 26XB   AUTHORISATION OF COLLECTION, USE AND DISCLOSURE OF PERSONAL INFORMATION  

26XB(1)    
At any time when an eligible data breach declaration is in force in relation to an eligible data breach, an entity may collect, use or disclose personal information about an individual if:

(a)    the entity reasonably believes that the individual may be at risk from the eligible data breach; and

(b)    the collection, use or disclosure is for a permitted purpose specified in the declaration; and

(c)    the information is information of a kind or kinds specified in the declaration; and

(d)    the information is disclosed by an entity specified in the declaration, or an entity included in a class of entities specified in the declaration; and

(e)    the information is disclosed to an entity specified in the declaration, or an entity included in a class of entities specified in the declaration; and

(f)    if a matter mentioned in paragraph (b) , (c) , (d) or (e) is specified in the declaration subject to conditions - those conditions are satisfied.

26XB(2)    
An entity is not liable to any proceedings for contravening a secrecy provision in respect of a use or disclosure of personal information authorised by subsection (1) unless the secrecy provision is a designated secrecy provision (see subsection (6) ).

26XB(3)    
An entity is not liable to any proceedings for contravening a duty of confidence in respect of a disclosure of personal information authorised by subsection (1) .

26XB(4)    
An entity does not breach an Australian Privacy Principle, a registered APP code that binds the entity or a rule issued under section 17 (rules relating to tax file number information) in respect of a collection, use or disclosure of personal information authorised by subsection (1) .

26XB(5)    
A collection, use or disclose of personal information by an officer or employee of an agency in the course of duty as an officer or employee is authorised by subsection (1) only if the officer or employee is authorised by the agency to collect, use or disclose the personal information.

26XB(6)    
In this section:

designated secrecy provision
means any of the following:

(a)    sections 18 , 18A , 18B , 34GF , 35P , 92 and 92A , and subsection 34GE(4) , of the Australian Security Intelligence Organisation Act 1979 ;

(b)    section 15LC of the Crimes Act 1914 ;

(c)    section 34 of the Inspector-General of Intelligence and Security Act 1986 ;

(d)    sections 39, 40C, 40D and 41 of, and clause 9 of Schedule 1 to, the Intelligence Services Act 2001 ;

(e)    sections 42 and 44 of the Office of National Intelligence Act 2018 ;

(f)    sections 22, 22A and 22B of the Witness Protection Act 1994 ;

(g)    a provision of a Commonwealth law prescribed by the regulations for the purposes of this paragraph;

(h)    a provision of a Commonwealth law of a kind prescribed by the regulations for the purposes of this paragraph.

secrecy provision
means a provision of a Commonwealth law (including a provision of this Act) that prohibits or regulates the use or disclosure of personal information, whether the provision relates to the use or disclosure of personal information generally or in specified circumstances.