Clause 6

the disclosure of that personal data by A to another organisation (B);

the collection and use of that personal data by B;

the disclosure of that personal data by B to another organisation.(4) Where an organisation collects personal data disclosed to it by B under subsection (3)(c), subsection (3)(b) and (c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (3)(a).(5) Subsections (3) and (4) apply to personal data provided before the applicable date by an individual to an organisation with a view to the individual entering into a contract with the organisation —

on or after the applicable date; or

which contract was entered into before the applicable date and remains in force on that date,as if subsections (3) and (4) —

were in force when the personal data was so provided; and

had continued in force until the applicable date.(6) Without limiting subsection (2) and subject to subsection (9), an individual (P) who enters into a contract with an organisation (A) and provides personal data to A pursuant or in relation to that contract is deemed to consent to the following:

the disclosure of that personal data by A to another organisation (B), where the disclosure is reasonably necessary —

for the performance of the contract between P and A; or

for the conclusion or performance of a contract between A and B which is entered into at P’s request, or which a reasonable person would consider to be in P’s interest;

the collection and use of that personal data by B, where the collection and use are reasonably necessary for any purpose mentioned in paragraph (a);

the disclosure of that personal data by B to another organisation, where the disclosure is reasonably necessary for any purpose mentioned in paragraph (a).(7) Where an organisation collects personal data disclosed to it by B under subsection (6)(c), subsection (6)(b) and (c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (6)(a).(8) Subsections (6) and (7) apply to personal data provided before the applicable date by an individual to an organisation in relation to a contract that the individual entered into before that date with the organisation, and which remains in force on that date, as if subsections (6) and (7) —

were in force when the personal data was so provided; and

had continued in force until the applicable date.(9) Subsections (3), (4), (5), (6), (7) and (8) do not affect any obligation under the contract between P and A that specifies or restricts —

the personal data provided by P that A may disclose to another organisation; or

the purposes for which A may disclose the personal data provided by P to another organisation.(10) In this section, “applicable date” means the date of commencement of section 6 of the Personal Data Protection (Amendment) Act 2020.”.