Unauthorised use or disclosure of protected information
71 Unauthorised use or disclosure of protected information
Entrusted person
A person commits an offence if:
the person is, or has been, an entrusted person; and
the person has obtained or generated information in the course of or for the purposes of:
performing functions or duties, or exercising powers, under this Act; or
assisting another person to perform functions or duties, or exercise powers, under this Act; or
providing data services to the Director‑General; or
receiving information given in accordance with a request or agreement under subsection 43(1) or a direction under subsection 45(1); and
the information is protected information; and
the person uses or discloses the information.
Penalty: Imprisonment for 2 years or 120 penalty units, or both.
A person commits an offence if:
the person is, or has been, an entrusted person; and
the person has obtained information as a result of a disclosure under section 51 made for the purpose of assisting the person, or another person, to perform a function or duty, or exercise a power, under:
the National Health Security Act 2007; or
the National Occupational Respiratory Disease Registry Act 2023; and
the information is protected information; and
the person uses or discloses the information.
Penalty: Imprisonment for 2 years or 120 penalty units, or both.
Person employed or engaged by prescribed public health entity that is a Commonwealth entity
A person commits an offence if:
the person is not an entrusted person; and
the person is employed or engaged (however described) by a prescribed public health entity to provide services to the prescribed public health entity; and
the prescribed public health entity is a Commonwealth entity; and
the person has obtained or generated information as a result of a use or disclosure of information authorised by this Act; and
the information is protected information; and
the person uses or discloses the information.
Penalty: Imprisonment for 2 years or 120 penalty units, or both.
Person employed or engaged by prescribed public health entity that is not a Commonwealth entity
A person commits an offence if:
the person is not an entrusted person; and
the person is employed or engaged (however described) by a prescribed public health entity to provide services to the prescribed public health entity; and
the prescribed public health entity is not a Commonwealth entity; and
the person has obtained or generated information as a result of a use or disclosure of information authorised by this Act; and
the information is protected information; and
the person uses or discloses the information.
Penalty: Imprisonment for 1 years or 60 penalty units, or both.
Exception—good faith
Subsections (1) to (4) do not apply if the person uses or discloses the information in good faith:
in the purported performance of functions or duties, or the purported exercise of powers, under:
this Act; or
the Biosecurity Act 2015; or
the National Health Security Act 2007; or
the National Occupational Respiratory Disease Registry Act 2023; or
in assisting another person in the purported performance of the other person’s functions or duties, or the purported exercise of the other person’s powers, under an Act mentioned in paragraph (a).
A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code).
Exception—required or authorised by law
Subsections (1) to (4) do not apply if the use or disclosure of the information is required or authorised by:
this Act or another law of the Commonwealth; or
a law of a State or Territory prescribed by the rules for the purposes of this paragraph.
A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code).
This Act’s bill:Explanatory memorandumSecond reading speech
The statute text is free to read above. View subscription options to unlock the case-law research tools for each provision.