(1) The Secretary or a relevant person must not disclose relevant information to a person or body under section 66(1)(a)(ii) or (iii) or (e), unless the person or body has first entered into an information protection agreement with the Secretary.
(2) An information protection agreement must—
(a) specify—
(i) the purpose for which the information is proposed to be disclosed to the person or body; and
(ii) the provision of this Act under which the Secretary is authorised to disclose the information; and
(iii) the means by which the information will be provided by the Secretary; and
(iv) the means by which the information will be protected by the person or body; and
(v) how compliance with the terms of the agreement will be monitored and enforced by each party to the agreement; and
(vi) the auditing arrangements; and
(vii) the procedures for managing any breach of privacy; and
(b) include an undertaking by the person or body that the information will be used or disclosed only for the purpose specified in the agreement.
(3) An information protection agreement may include any other requirements, qualifications or conditions specified by the Secretary.
(4) Subsection (1) does not apply if—
(a) an information protection agreement is currently in force between the Secretary and the delegator, employer, contractor or principal of the person or body who has requested the relevant information; and
(b) in making the request for the relevant information, the person or body is acting within the scope of their actual or apparent authority under the delegation, employment, contractual relationship or agency.
(5) If a person or body requests relevant information other than for a purpose specified in subsection (1), the Secretary or a relevant person may require the person or body to first enter into an information protection agreement with the Secretary.
(6) A person or body is not required to enter into an information protection agreement with the Secretary in relation to the use or disclosure of relevant information if—
(a) the person or body is a relevant person; and
(b) the relevant information is disclosed to the person or body in their capacity as a relevant person.