consent of the individual is required or authorised under this Act or other written law.
Collection, use and disclosure without consent
17.—(1) An organisation may collect personal data about an individual, without consent or from a source other than the individual, only in the circumstances and subject to any condition in the Second Schedule.
(2) An organisation may use personal data about an individual, without the consent of the individual, only in the circumstances and subject to any condition in the Third Schedule.
(3) An organisation may disclose personal data about an individual, without the consent of the individual, only in the circumstances and subject to any condition in the Fourth Schedule.
Division 2—Purpose
Limitation of purpose and extent
18. An organisation may collect, use or disclose personal data about an individual only for purposes—
- (a) that a reasonable person would consider appropriate in the circumstances; and
- (b) that the individual has been informed of under section 20, if applicable.
Personal data collected before appointed day
19. Notwithstanding the other provisions in this Part, an organisation may use personal data about an individual collected before the appointed day for the purposes for which the personal data was collected unless—
- (a) consent for such use is withdrawn in accordance with section 16; or
- (b) the individual, whether before, on or after the appointed day, has otherwise indicated to the organisation that he does not consent to the use of the personal data.
