Consent is a different matter. Consent under the Privacy Act is also grounds for permissible disclosure. What we are dealing with here are the other provisions of section 8, which authorize disclosure other than consent, including consistent use. The elements that we have in mind, at a minimum, would be these: What is the personal information, exactly, that is being shared between the two institutions? What is the purpose? Beyond a consistent purpose, what is the specific purpose for which the information is being shared? Are there some accountability measures as to who actually decides, and what kind of information exists to ensure we can monitor this after the fact? We cannot regulate in the same way all sharing of information between all departments, so agreements would have certain minimal content, which I described, but the rest would be up to each agreement.
On March 10th, 2016. See this statement in context.