Unauthorised use or disclosure of protected information

In force

(1)

A person commits an offence if:

(a)

the person is, or has been, an entrusted person; and

(b)

the person has obtained or generated information in the person’s capacity as an entrusted person; and

(c)

the information is protected information; and

(d)

the person uses or discloses the information.

Penalty: Imprisonment for 2 years or 120 penalty units, or both.

(2)

A person commits an offence if:

(a)

the person uses or discloses information; and

(b)

the information is protected information; and

(c)

the information was disclosed to the person; and

(d)

the disclosure of the information to the person was authorised by or under any of the following provisions of this Act:

(i)

subsection 537(8) (reasonable belief about threats to safety, etc.);

(ii)

subsection 537(10) (functions under certain laws relating to worker screening);

(iii)

subsection 538(1) (performance of Minister’s functions);

(iv)

subsection 538(4) (individual accessing funded aged care services);

(v)

section 539 (use or disclosure by the System Governor or Appointed Commissioner);

(vi)

subsection 540(1) (coronial inquiries, etc.);

(vii)

subsection 540(2) (health complaints, etc.);

(viii)

subsection 541(1) (grants); and

(e)

the person is not, and has never been, an entrusted person or, if the person is or has been an entrusted person, the information was not disclosed to the person in that capacity; and

(f)

the purpose for which the person uses or discloses the information is not the purpose for which the information was disclosed to the person.

Penalty: Imprisonment for 2 years or 120 penalty units, or both.

(3)

Subsections (1) and (2) do not apply to a use or disclosure authorised by a provision of Division 2.

Note 1:

A defendant bears an evidential burden in relation to the matter in subsection (3): see subsection 13.3(3) of the Criminal Code.

Note 2:

Division 2 authorises the use and disclosure of protected information and relevant information in various circumstances. As well as having effect for the purposes of subsection (3), these authorisations have effect for the purposes of the Privacy Act 1988.

(4)

Subsection (2) does not apply to the following:

(a)

conduct of individuals accessing, or seeking to access, funded aged care services;

(b)

conduct of supporters of those individuals;

(c)

conduct of registered providers.

Note:

A defendant bears an evidential burden in relation to the matter in subsection (4): see subsection 13.3(3) of the Criminal Code.

This Act’s bill:Explanatory memorandum Second reading speech

Research tools for this sectionSubscription

Cited by Analyse Interrogate History Equivalents

The statute text is free to read above. View subscription options to unlock the case-law research tools for each provision.

535 Unauthorised use or disclosure of protected information