Competition and Consumer Act 2010

For the purposes of subparagraph 79(2)(a)(ii) of the Regulatory Powers Act, each of the following provisions of this Division (the privacy safeguard penalty provisions) is a civil penalty provision:

subsection 56ED(3);

subsection 56EF(1);

subsection 56EG(1);

section 56EH;

subsection 56EI(1) or (2);

subsection 56EJ(1) or (2);

subsection 56EK(1);

subsection 56EL(1) or (2);

subsection 56EM(1), (2) or (4);

subsection 56EN(1), (2), (2A), (3) or (4);

subsection 56EO(1) or (2);

subsection 56EP(1) or (2).

Each privacy safeguard penalty provision is enforceable under Part 4 of the Regulatory Powers Act.

Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.

For the purposes of Part 4 of the Regulatory Powers Act, the Information Commissioner is an authorised applicant in relation to each privacy safeguard penalty provision.

For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to each privacy safeguard penalty provision:

the Federal Court;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

If an act or omission constitutes:

a contravention of one or more of the privacy safeguard penalty provisions; and

a contravention of one or more civil penalty provisions of the consumer data rules;

The proceedings for a contravention referred to in paragraph (a) would be instituted under Part 4 of the Regulatory Powers Act.

The proceedings for a contravention referred to in paragraph (b) would be instituted under Part VI of this Act.

However, the person is not liable to more than one pecuniary penalty under:

Part 4 of the Regulatory Powers Act for a contravention referred to in paragraph (5)(a) of this section; and

Part VI of this Act for a contravention referred to in paragraph (5)(b) of this section;

This means the person cannot be liable for a pecuniary penalty for a contravention of the privacy safeguards, and for a pecuniary penalty for a contravention of the consumer data rules, in relation to the same act or omission.