In certain situations Australian privacy law requires that an organisation or agency needs your consent to collect your personal information, and to use or disclose it. Show
Your consent is generally needed for the collection of your or to use or disclose your personal information for a purpose other than the purpose it was collected for. Express consentYou give express consent if you give it openly and obviously, either verbally or in writing. For example, when you sign your name (by hand, or by an electronic or voice signature). An organisation or agency must get your express consent before handling your sensitive information. Implied consentAn organisation or agency doesn’t need your express consent to handle your non-sensitive personal information; but they need to reasonably believe that they have your implied consent. It’s not sufficient for an organisation or agency simply to tell you of their collection, use or disclosure of your personal information. Unless they presented you with an opt-out option they cannot assume your implied consent. Example: opt-out optionAn organisation or agency writes to you to say they’ll be disclosing your customer information for another purpose unless you opt-out within 30 days. If you don’t contact them within 30 days, then they can assume they have your implied consent to use or disclose your customer information for the purpose they wrote to you about. However, the situation isn’t always clear cut. Since consent must be informed, an organisation or agency needs to make sure:
Bundled consentA bundled consent is a single request for consent from an organisation or agency that contains several requests to collect, use and disclose your personal information, and does not let you choose which ones you consent to and which you don’t. For example, if a medical practice issues a bundled request for consent to use your personal information for medical research purposes and direct marketing, and to disclose it to a third-party marketing company. In this case, you would not be able to agree to the use of your personal information for medical research without agreeing to receiving marketing materials. Avoid giving bundled consent unless the request:
Can you withdraw your consent?You can withdraw your consent at any time. The organisation or agency concerned must make sure the process is easy and accessible, and that you understand the possible consequences of withdrawing your consent. For example, you may no longer have access to a service. Once you withdraw consent, an organisation or agency can’t rely on your past consent for any future use or disclosure of your personal information. More about what consent involvesConsent must be informedYour consent is only valid if you’re aware of the consequences of giving or not giving your consent at the time you make the decision. An organisation or agency should:
Consent must be voluntaryYou give voluntary consent if you’re not forced or pressured to give your consent. Some factors that decide if consent is voluntary are:
Consent must be current and specificWhen you give consent at a particular time and for specific circumstances, an organisation or agency can’t assume your consent continues indefinitely. When asking for your consent, an organisation or agency must explain the reason for their request and be as specific as possible. They shouldn’t ask for a broader consent than is necessary. For example, you shouldn’t be asked to consent to undefined future uses or vague statements such as ‘all legitimate uses or disclosures’. You must have capacity to give consentYou must have the capacity to give consent. This means you:
Common situations (‘alerts’) where you may not be able to give your consent include:
What if an individual lacks capacity?If an organisation or agency is unsure if an individual has the capacity to give consent at a particular time, then they shouldn’t rely on any consent decision the individual makes at that particular time. Instead, they should think about offering support, such as an interpreter. If such support is insufficient, then an organisation or agency may consider if someone can act on the individual’s behalf, such as:
As far as practical, an organisation or agency should involve the individual who lacks capacity in the consent decision. Can you withdraw your consent?Individuals must be able to withdraw their consent to processing without suffering any detriment. If there is a penalty for withdrawing consent, the consent would be invalid as it would not be freely given. See 'When is consent valid? ' for more on freely given consent.
When can participants withdraw their data from a study?As a research participant, you can leave a research study at any time.
What is the right to withdraw in research?In giving consent, participants have the right to withdraw this consent as well as the right not to answer particular questions. All research should indicate the point at which data will have been anonymised and amalgamated and in certain circumstances cannot then be excluded.
|