Authority for the data custodian to provide identifiable data to an integrating authority can also be obtained through consent from the data provider (where this is not precluded by legislation). In such cases, data custodians must assure themselves that appropriate informed consent has been provided for the disclosure of identifiable data for statistical or research purposes.
The Office of the Australian Information Commissioner (OAIC) has defined consent as free and informed agreement with what is being done or proposed. Consent can be either express (given explicitly either verbally or in writing) or implied (where consent may be reasonably inferred in the circumstances from the conduct of the individual).
The OAIC recommends that in the handling of personal health information deemed ‘sensitive’ under the Privacy Act 1988, undue reliance should not be placed upon implied consent.
The OAIC holds that the key elements of consent are:
- it must be provided voluntarily;
- the individual must be adequately informed; and
- the individual must have the capacity to understand, provide and communicate their consent.
For more information on informed consent see the Office of the Australian Information Commissioner’s website www.oaic.gov.au.
For more information about the authorisation to release identifiable data see:
- Examples of legislated authorisation
- Human Research Ethics Committee Approvals
- Informed consent
- Public interest determinations