(1) The use or disclosure by an entity of personal information about an individual is taken, for the purposes of the Privacy Act 1988 , to be authorised by this Act if the use or disclosure is for the purposes of the Registrar performing his or her functions or exercising his or her powers.
(2) The use or disclosure by the Registrar of personal information about an individual is taken, for the purposes of the Privacy Act 1988 , to be authorised by this Act if the use or disclosure is for the purposes of research:
(a) that relates (directly or indirectly) to education or training, or that requires the use of student identifiers or information about education or training; and
(b) that meets the requirements specified by the Ministerial Council.
(3) The use or disclosure by the Registrar of personal information about an individual is taken, for the purposes of the Privacy Act 1988 , to be authorised by this Act if the use or disclosure is for the purposes of research:
(a) that relates (directly or indirectly) to the provision of higher education; and
(b) that meets the requirements specified in an instrument under subsection (4).
(4) The Education Minister must, by legislative instrument, specify requirements for the purposes of paragraph (3)(b).