(1) Personal information must not be collected by the Australian Curriculum, Assessment and Reporting Authority unless the collection is necessary for, and directly related to, any of the following purposes:
(a) conducting research relating to the national school curriculum;
(b) assisting government to formulate policies in relation to education matters;
(c) formulating national reports consisting of aggregated data on school performance.
(2) The use of personal information collected by the Australian Curriculum, Assessment and Reporting Authority in accordance with subsection (1) or lawfully disclosed to the Australian Curriculum, Assessment and Reporting Authority is taken to be authorised by law for the purposes of Information Privacy Principle 10 in section 14 of the Privacy Act 1988 if the use is necessary for, and directly related to, any of the purposes mentioned in that subsection.
(3) The disclosure of personal information by the Australian Curriculum, Assessment and Reporting Authority is taken to be authorised by law for the purposes of Information Privacy Principle 11 in section 14 of the Privacy Act 1988 if:
(a) the disclosure is made to a person or body that is prescribed by the regulations; and
(b) the disclosure is necessary for, and directly related to, the purposes mentioned in subsection (1).
Note: Paragraph 3 of Information Privacy Principle 11 in section 14 of the Privacy Act 1988 applies to further disclosures of the personal information