§ 17 — Collection, use and disclosure without consent

17.—(1) An organisation may —(a)

collect personal data about an individual, without the individual’s consent or from a source other than the individual, in the circumstances or for the purposes, and subject to any condition, in the First Schedule or Part 1 of the Second Schedule;

(b)

use personal data about an individual without the individual’s consent, in the circumstances or for the purposes, and subject to any condition, in the First Schedule or Part 2 of the Second Schedule; or

(c)

disclose personal data about an individual without the individual’s consent, in the circumstances or for the purposes, and subject to any condition, in the First Schedule or Part 3 of the Second Schedule.[40/2020]

(2) Unless otherwise provided under this Act, an organisation may —(a)

collect personal data about an individual that the organisation receives by way of a disclosure to the organisation —(i)

on or after 1 February 2021 in accordance with subsection (1)(c); or

(ii)

before 1 February 2021 in accordance with section 17(3) as in force before that date,

for purposes consistent with the purpose of that disclosure, or for any purpose permitted by subsection (1)(a); or

(b)

use or disclose personal data about an individual that —(i)

is collected by the organisation on or after 1 February 2021 in accordance with subsection (1)(a); or

(ii)

was collected by the organisation before 1 February 2021 in accordance with section 17(1) as in force before that date,

for purposes consistent with the purpose of that collection, or for any purpose permitted by subsection (1)(b) or (c), as the case may be.

[40/2020]

—(1) An organisation may —(a)

collect personal data about an individual, without the individual’s consent or from a source other than the individual, in the circumstances or for the purposes, and subject to any condition, in the First Schedule or Part 1 of the Second Schedule;

(b)

use personal data about an individual without the individual’s consent, in the circumstances or for the purposes, and subject to any condition, in the First Schedule or Part 2 of the Second Schedule; or

(c)

disclose personal data about an individual without the individual’s consent, in the circumstances or for the purposes, and subject to any condition, in the First Schedule or Part 3 of the Second Schedule.[40/2020]

(2) Unless otherwise provided under this Act, an organisation may —(a)

collect personal data about an individual that the organisation receives by way of a disclosure to the organisation —(i)

on or after 1 February 2021 in accordance with subsection (1)(c); or

(ii)

before 1 February 2021 in accordance with section 17(3) as in force before that date,

for purposes consistent with the purpose of that disclosure, or for any purpose permitted by subsection (1)(a); or

(b)

use or disclose personal data about an individual that —(i)

is collected by the organisation on or after 1 February 2021 in accordance with subsection (1)(a); or

(ii)

was collected by the organisation before 1 February 2021 in accordance with section 17(1) as in force before that date,

for purposes consistent with the purpose of that collection, or for any purpose permitted by subsection (1)(b) or (c), as the case may be.

[40/2020]