Australian Centre for Disease Control Act 2025

The Director‑General may, by legislative instrument, specify entities that are prescribed public health entities for the purposes of this Act.

The Director‑General may specify an entity under subsection (1) only if the Director‑General is satisfied that:

the entity:

has functions, duties or powers, under a law of the Commonwealth or a State or Territory, relating to prescribed public health activities; or

carries out prescribed public health activities on behalf of the Commonwealth or a State or Territory; and

specifying the entity would be consistent with any trusted access principles made under subsection (5).

Also, the Director‑General may specify an entity under subsection (1) only if the Director‑General is satisfied that:

the entity is an APP entity (within the meaning of the Privacy Act 1988); or

if paragraph (a) does not apply—the entity is subject to a law of a State or Territory that substantially corresponds to the Privacy Act 1988; or

if neither paragraph (a) nor (b) applies—the entity has entered into an agreement under subsection (4).

For the purposes of paragraph (3)(c), the Director‑General may enter into a written agreement with an entity that prohibits the entity from collecting, holding, using or disclosing personal information in any way that would, if the entity were an organisation within the meaning of the Privacy Act 1988, breach an Australian Privacy Principle.

The Director‑General may, by legislative instrument, determine trusted access principles for the purposes of paragraph (2)(b).