National Cancer Screening Register Act 2016

If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner.

This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.

If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify:

the Secretary; and

the Information Commissioner.

This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.

A notice given under subsection (1) or (2) must set out the following:

a description of the contravention that has occurred or may have occurred;

the kind or kinds of information concerned;

if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider.

If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:

so far as is reasonably practicable, contain the possible contravention;

evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention;

if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register:

in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or

in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected.

This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing.

If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:

so far as is reasonably practicable, contain the contravention and undertake a preliminary assessment of the causes;

evaluate any risks that may be related to or arise out of the contravention;

in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected;

in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected;

take steps to prevent or mitigate the effects of further contraventions.

This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the contravention, regardless of when it occurred or whether it is ongoing.

The Secretary must comply with a request under subparagraph (4)(c)(ii) or paragraph (5)(d).

A person is not required to comply with subsection (1) or (2) in relation to a contravention that has occurred if the person has already given notice under that subsection that the contravention may have occurred.

A person is not required to comply with paragraph (5)(c) or (d) in relation to a contravention if the person has already consulted, or asked the Secretary to consult, the Information Commissioner under paragraph (4)(c) in relation to the contravention.

A contracted service provider or former contracted service provider is not required to comply with subsection (2), subparagraph (4)(c)(ii) or paragraph (5)(d) in relation to a contravention that has, or may have, occurred if another person has already:

given notice in relation to the contravention under subsection (1) or (2); or

consulted, or asked the Secretary to consult, the Information Commissioner in relation to the contravention under paragraph (4)(c) or (5)(c) or (d).

In this Act:

is engaged under an agreement referred to in section 26; and

obtains protected information in the course of performing services under the agreement.