(1) This Part does not affect the handling of data that would otherwise be permitted by or under the Privacy and Data Protection Act 2014 , the Health Records Act 2001 or any other Act.
(2) Except as expressly provided by this Part, this Act does not affect obligations under the Privacy and Data Protection Act 2014 or the Health Records Act 2001 in relation to the handling of identifiable data.
(3) If the Chief Data Officer or a data analytics body becomes aware that this Act, the Privacy and Data Protection Act 2014 or the Health Records Act 2001 has been, or is likely to have been, breached in relation to data handled under this Act while in the control of the Chief Data Officer or of the data analytics body, the Chief Data Officer or the data analytics body must, as soon as practicable after becoming aware of the possible breach, inform—
(a) in the case of a breach of this Act or the Privacy and Data Protection Act 2014 , the Information Commissioner; and
(b) in the case of a breach of the Health Records Act 2001 , the Health Complaints Commissioner; and
(c) in any case, the data sharing body or designated body who provided the data.