---
title: "Check a proposed secondary use against the use-and-disclosure rule"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-a-proposed-secondary-use-against-the-use-and-disclosure-rule"
type: "task"
site: "AI Law Framework"
id: "A24-SF20261022-18"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Check a proposed secondary use against the use-and-disclosure rule

> From the collection notice and the proposed use, state the purpose the information was collected for and the new purpose, and list which exception the file claims. Leave blank whether the exception is made out.…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-a-proposed-secondary-use-against-the-use-and-disclosure-rule  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the collection notice and the proposed use, state the purpose the information was collected for and the new purpose, and list which exception the file claims. Leave blank whether the exception is made out. The tool does not make the disclosure. |
| What the lawyer must review | OAIC Chapter 6 says an APP entity that holds personal information may use or disclose it only for the primary purpose of collection, unless an exception applies. Holds includes a record the entity has the right or power to deal with, not only physical possession. The chapter lists these exceptions: consent, a reasonable expectation where the secondary purpose is related to the primary purpose, or directly related if the information is sensitive, a use or disclosure required or authorised by or under an Australian law or a court or tribunal order, a permitted general situation, a permitted health situation for an organisation, a reasonable belief that the use or disclosure is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body, and the biometric disclosure in APP 6.3. Personal information other than sensitive information may also be disclosed to a related body corporate. APP 6 does not apply to direct marketing, which is APP 7, or to government related identifiers, which is APP 9. Consent has the four elements on the page. A related purpose needs more than a tenuous link. The detailed content of permitted general situations, permitted health situations and enforcement related activities was not opened beyond the list in the chapter, so the lawyer reads that part before relying on one of them. The direct-marketing check is a separate task. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the collection notice and the proposed use, state the purpose the information was collected for and the new purpose, and list which exception the file claims. Leave blank whether the exception is made out. The tool does not make the disclosure.
- What the lawyer does: OAIC Chapter 6 says an APP entity that holds personal information may use or disclose it only for the primary purpose of collection, unless an exception applies. Holds includes a record the entity has the right or power to deal with, not only physical possession. The chapter lists these exceptions: consent, a reasonable expectation where the secondary purpose is related to the primary purpose, or directly related if the information is sensitive, a use or disclosure required or authorised by an Australian law or a court or tribunal order, a permitted general situation, a permitted health situation for an organisation, a reasonable belief that the use or disclosure is reasonably necessary for an enforcement related activity, and the biometric disclosure in APP 6.3. Personal information other than sensitive information may also be disclosed to a related body corporate. APP 6 does not apply to direct marketing, which is APP 7, or to government related identifiers, which is APP 9. Consent has the four elements on the page. A related purpose needs more than a tenuous link. The detailed content of permitted general situations, permitted health situations and enforcement related activities was not opened beyond the list in the chapter, so the lawyer reads that part before relying on one of them. The direct-marketing check is a separate task.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. If the new purpose is direct marketing, use the direct-marketing task. APP 6 does not apply to that use.
2. Record the primary purpose from the collection notice before naming an exception.
3. For sensitive information, the related-purpose exception requires a purpose that is directly related.
4. Do not rely on a permitted general situation, a permitted health situation or an enforcement activity until that part of the chapter has been read. It was not opened beyond the list.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: Chapter 6, APP 6 Use or disclosure of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-6-app-6-use-or-disclosure-of-personal-information) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-a-proposed-secondary-use-against-the-use-and-disclosure-rule/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*