Data Sharing (Government Sector) Act 2015

Without limiting section 5 (2), a data provider and data recipient must ensure that health information or personal information contained in government sector data that is shared is not collected, used, disclosed, protected, kept, retained or disposed of otherwise than in compliance with the privacy legislation.

If a data recipient that is provided with government sector data that contains health information or personal information becomes aware that the privacy legislation has been (or is likely to have been) contravened in relation to that information while in the recipient’s control, the data recipient must, as soon as is practicable after becoming aware of it, inform the data provider and the Privacy Commissioner of the contravention or likely contravention.