Yes it can, but only in limited circumstances.

Section 95 of the Privacy Act 1988 allows the National Health and Medical Research Council (NHMRC) to issue Guidelines under Section 95 of the Privacy Act 1988. In accordance with these guidelines, requests can be made to Commonwealth agencies to disclose personal information for medical research. The guidelines, which must be approved by the Privacy Commissioner, require that requests to use your personal information (without consent) for medical research must first be approved by a Human Research Ethics Committee (HREC). These protections have been in place since the Privacy Act was passed in 1988.

However, before that the researcher must consider whether it is practical to seek your consent to use your personal information for the research project. If this is not possible, the researcher must consider whether they can use de-identified information, this is information from which you cannot be identified. If neither step is possible, then the researcher may decide to seek approval to use your information without your consent.

The guidelines set out the framework for a HREC to use when deciding whether to allow the research to proceed. As part of its deliberations, the HREC must determine if the public interest in the research substantially outweighs the public interest in privacy, before the proposal can be approved.

If a researcher receives approval from a HREC to proceed with the research, then they can approach the Commonwealth agency that holds your information to seek its release. Either the agency can decide to release the information or it can refuse.