Under the APP, when can a company use or disclose personal information that it holds?

A company can use or disclose personal information it holds primarily when it has obtained the individual's consent. This principle underpins privacy laws and regulations, emphasizing the necessity of individual autonomy and control over personal data. Consent ensures that individuals are aware of how their information will be utilized and have the opportunity to agree to this use.

In many jurisdictions, this consent must be informed, meaning individuals should understand what their consent entails, including the purpose of data use and who will be receiving the data. This approach aligns with ethical data practices and helps in building trust between individuals and organizations regarding the handling of sensitive personal information.

Although there are specific situations, such as legal obligations, where companies may be permitted to use information without consent, these scenarios are generally exceptions rather than the norm. Thus, consent remains the foundational principle guiding the use and disclosure of personal information.