Privacy and Data Protection Act 2014

If an Information Privacy Principle or an applicable code of practice requires the consent of an individual to the collection, holding, management, use or disclosure of personal information or to the transfer of personal information to someone who is outside Victoria, an authorised representative of the individual may give that consent if—

the individual is incapable of giving consent; and

the consent is reasonably necessary for the lawful performance of functions or duties or exercise of powers in respect of the individual by the authorised representative.

If an Information Privacy Principle or an applicable code of practice empowers an individual to request access to, or the correction of, personal information or confers on an individual a right of access to personal information, the power to make that request, or that right of access, may be exercised—

by—

the individual personally, except if the individual is a child who is incapable of making the request; or

a supportive attorney acting under a supportive attorney appointment, within the meaning of the Powers of Attorney Act 2014; or

a supportive administrator acting under a supportive administration order within the meaning of the Guardianship and Administration Act 2019; or

a supportive guardian acting under a supportive guardianship order within the meaning of the Guardianship and Administration Act 2019; and

by an authorised representative of the individual if—

the individual is incapable of making the request or exercising the right of access; and

the personal information to be accessed is reasonably necessary for the lawful performance of functions or duties or exercise of powers in respect of the individual by the authorised representative.

For the purposes of subsections (1) and (2), an individual is incapable of giving consent, making the request or exercising the right of access if the individual is incapable (despite the provision of reasonable assistance by another individual) by reason of age, injury, disease, senility, illness, disability, physical impairment or mental disorder of—

understanding the general nature and effect of giving the consent, making the request or exercising the right of access (as the case requires); or

communicating the consent or refusal of consent, making the request or personally exercising the right of access (as the case requires).

An authorised representative of an individual must not give consent or request access to, or the correction of, personal information if the authorised representative knows or believes that the consent or request does not accord with the wishes expressed, and not changed or withdrawn, by the individual before the individual became incapable of giving consent or requesting access and any purported consent given or request made in those circumstances is of no effect.

An organisation may refuse a request by an authorised representative of an individual for access to the personal information of the individual if the organisation reasonably believes that access by the authorised representative may endanger the individual.

In this section—

means a person who is—

a guardian of the individual; or

an attorney for the individual under an enduring power of attorney; or

a medical treatment decision maker for the individual within the meaning of the Medical Treatment Planning and Decisions Act 2016; or

a support person for the individual within the meaning of the Medical Treatment Planning and Decisions Act 2016; or

an administrator within the meaning of the Guardianship and Administration Act 2019; or

a parent of an individual, if the individual is a child; or

otherwise empowered under law to perform any functions or duties or exercise powers as an agent of or in the best interests of the individual; and

does not include a person acting as an authorised representative of the individual if that acting is inconsistent with an order made by a court or tribunal;