1

FAIR AND LAWFUL PROCESSING
1.1 Fair and Lawful Processing: During the Term of this agreement each party shall ensure that it processes the Shared Data fairly and lawfully in accordance with Clause 5.2 and Clause 5.3.
1.2 Grounds for Processing: Each party shall ensure that it processes Shared Data on the basis of one or more of the following legal grounds:

  1. Data Subject has freely given his or her explicit, unambiguous consent;
  2. processing is necessary for the performance of a contract to which the Data Subject is a party or in order to take steps at the request of the Data Subject prior to entering into a contract;
  3. processing is necessary for compliance with a legal obligation to which the parties are subject, other than an obligation imposed by contract;
  4. processing is necessary in order to protect the vital interests of the Data Subject; or
  5. processing is necessary for the purposes of the legitimate interests pursued by the parties except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the Data Subject.
1.3 Grounds for Sensitive Personal Data and Special Categories of Personal Data Processing: In addition to its obligations under Clause 5.2, each party shall ensure that it processes Shared Data classified as Sensitive Personal Data or a Special Category of Personal Data on the basis of the Data Subject having given his or her explicit consent to the processing of the Shared Data.
1.4 Consent to Sharing of Shared Data: Each party shall ensure that in the event of the Data Discloser processing the Shared Data on the basis of the legal ground specified under Clause 5.2(a) above:

  1. such consent includes the consent of the Data Subject to the sharing of the Shared Data with the Data Recipient;
  2. the Data Discloser can demonstrate that the Data Subject has consented to the processing of the Shared Data;
  3. such consent is otherwise given in accordance with Applicable Data Protection Laws.
1.5 Privacy Statement: Each Party shall, in respect of Shared Data, ensure that their privacy statements are clear and provide sufficient information to the Data Subjects for them to understand what of their personal data the Data Discloser is sharing with the Data Recipient, the circumstances in which it will be shared, the purposes for the data sharing and either the identity of the Data Recipient or a description of the type of organisation that will receive the personal data.
1.6 Information Obligation: Each Party undertakes to inform the Data Subjects, in accordance with Applicable Data Protection Laws, of the purposes for which it will process their personal data and provide all of the information that it must provide, in accordance with applicable laws, to ensure that the Data Subjects understand how their personal data will be processed by the Data Recipient.