The document discusses examples of data sharing arrangements in the EU, India, and Australia. The EU requires personal data collected for one purpose can only be processed for crime-related purposes if legal authorization allows it and processing is necessary and proportionate. India's Aadhaar Act allows disclosure of non-biometric data with a court order and biometric data for national security with government approval. Australia's Privacy Act permits using personal data for a different purpose than collected if for law enforcement or authorized by law or court order.

1. Box 11. Examples of data sharing arrangements
Article 4(2) of the EU 2016 Police and Criminal Justice Data Protection Directive 2016/680 requires
that personal data collected for some other purpose—which could be for an ID system or for civil
registration—can be processed by the same or another controller for crime-related purposes only in so
far as: (a) there is legal authorization for this and (b) such processing is necessary and proportionate to
the purpose for which the personal data was collected. (See, e.g., The Council of the EU, Data
Protection in Law Enforcement)
In India, the Aadhaar Act 2016 provides for the disclosure of information, excluding “core biometric
information,” pursuant to an appropriate court order, which can be made only after the Unique
Identification Authority of India (UIDAI) has been given an opportunity to give input on the disclosure.
It also provides for the disclosure of information, including core biometric information, “in the interest
of national security” on the direction of government officers above a certain rank, where this has been
authorized by an order of the central government and reviewed by an Oversight Committee consisting
of the Cabinet Secretary and the Secretaries to the Government in the Department of Legal Affairs and
the Department of Electronics and Information Technology.
In Australia, the federal Privacy Act 1988 (as amended) contains as one of its “Privacy Principles” the
rule that personal information about an individual collected for a particular purpose must not be used or
disclosed for another purpose without the individual’s consent. However, there is an exception for
situations where the use or disclosure is “reasonably necessary” for the enforcement related activities
conducted by or on behalf of an enforcement body – which includes use or disclosure by police for
prevention, detection, investigation, prosecution or punishment of criminal offences – as well as an
exception for uses and disclosures authorized by law or by court order. Use for enforcement related
activities must be noted in writing as a mechanism to promote accountability. (See also Privacy Act
reforms – implications for enforcement functions)
Source: Adapted from the ID Enabling Environment Assessment (IDEEA).