Capacity to consent

Individuals must be capable of providing consent for the collection, use or disclosure of personal information. Capable means they are able to:

• understand the information that is relevant to deciding whether to consent and
• appreciate the reasonably foreseeable consequences of giving, withholding or withdrawing the consent⁶⁶

When determining someone’s capacity to consent, you can presume that an individual of any age is capable, unless you have reasonable grounds to believe they are not. For example, while Part X does not link capacity to age or provide a minimum age for consent, it would be reasonable to conclude that an infant is incapable of providing consent.

Note that a person can be capable of consenting at one time, but incapable at another.⁶⁷
For example, a traumatic event or a new medication might temporarily affect an individual’s capacity to provide consent.

Individuals can also be capable of providing consent for some parts of their personal information, but not others.⁶⁸ For example, a child may be capable of consenting to the disclosure of most of her record to another service provider, but incapable of appreciating the consequences of disclosing or not disclosing a particularly sensitive part of the record.

When assessing if an individual is capable:

• provide them with all the relevant information, including the purpose for the proposed collection, use or disclosure. When you are collecting the information directly, advise them that it may be used or disclosed in accordance with Part X
• consider asking the individual to repeat the relevant information back to you — it may help you to assess their level of understanding
• ensure that language barriers, speech impairments or cultural differences do not influence your assessment of capacity