PRIVACY AND DATA PROTECTION ACT 2014 - SECT 28 Capacity to consent or make a request or exercise right of access

PRIVACY AND DATA PROTECTION ACT 2014 - SECT 28

    (1)     If an Information Privacy Principle or an applicable code of practice requires the consent of an individual to the collection, holding, management, use or disclosure of personal information or to the transfer of personal information to someone who is outside Victoria, an authorised representative of the individual may give that consent if—

        (a)     the individual is incapable of giving consent; and

        (b)     the consent is reasonably necessary for the lawful performance of functions or duties or exercise of powers in respect of the individual by the authorised representative.

    (2)     If an Information Privacy Principle or an applicable code of practice empowers an individual to request access to, or the correction of, personal information or confers on an individual a right of access to personal information, the power to make that request, or that right of access, may be exercised—

S. 28(2)(a) substituted by No. 64/2016 s. 16.

        (a)     by—

              (i)     the individual personally, except if the individual is a child who is incapable of making the request; or

S. 28(2)(a)(ii) amended by No. 13/2019 s. 221(Sch.  1 item 39.1).

              (ii)     a supportive attorney acting under a supportive attorney appointment, within the meaning of the Powers of Attorney Act 2014 ; or

S. 28(2)(a)(iii) inserted by No. 13/2019 s. 221(Sch.  1 item 39.2).

              (iii)     a supportive administrator acting under a supportive administration order within the meaning of the Guardianship and Administration Act 2019 ; or

S. 28(2)(a)(iv) inserted by No. 13/2019 s. 221(Sch.  1 item 39.2).

              (iv)     a supportive guardian acting under a supportive guardianship order within the meaning of the Guardianship and Administration Act 2019 ; and

        (b)     by an authorised representative of the individual if—

              (i)     the individual is incapable of making the request or exercising the right of access; and

              (ii)     the personal information to be accessed is reasonably necessary for the lawful performance of functions or duties or exercise of powers in respect of the individual by the authorised representative.

    (3)     For the purposes of subsections (1) and (2), an individual is incapable of giving consent, making the request or exercising the right of access if the individual is incapable (despite the provision of reasonable assistance by another individual) by reason of age, injury, disease, senility, illness, disability, physical impairment or mental disorder of—

        (a)     understanding the general nature and effect of giving the consent, making the request or exercising the right of access (as the case requires); or

        (b)     communicating the consent or refusal of consent, making the request or personally exercising the right of access (as the case requires).

    (4)     An authorised representative of an individual must not give consent or request access to, or the correction of, personal information if the authorised representative knows or believes that the consent or request does not accord with the wishes expressed, and not changed or withdrawn, by the individual before the individual became incapable of giving consent or requesting access and any purported consent given or request made in those circumstances is of no effect.

    (5)     An organisation may refuse a request by an authorised representative of an individual for access to the personal information of the individual if the organisation reasonably believes that access by the authorised representative may endanger the individual.

    (6)     In this section—

S. 28(6) def. of authorised representative amended by Nos 69/2016 s. 158, 13/2019 s. 221(Sch.  1 item 39.3).

"authorised representative", in relation to an individual—

        (a)     means a person who is—

              (i)     a guardian of the individual; or

              (ii)     an attorney for the individual under an enduring power of attorney; or

              (iii)     a medical treatment decision maker for the individual within the meaning of the Medical Treatment Planning and Decisions Act 2016 ; or

        (iiia)     a support person for the individual within the meaning of the Medical Treatment Planning and Decisions Act 2016 ; or

              (iv)     an administrator within the meaning of the Guardianship and Administration Act 2019 ; or

              (v)     a parent of an individual, if the individual is a child; or

              (vi)     otherwise empowered under law to perform any functions or duties or exercise powers as an agent of or in the best interests of the individual; and

        (b)     does not include a person acting as an authorised representative of the individual if that acting is inconsistent with an order made by a court or tribunal;

"disability" has the same meaning as in the Disability Act 2006 .

Division 5—Public interest determinations and temporary public interest determinations

Subdivision 1—Public interest determinations