36Confidentiality of information

#### 36 Confidentiality of information (1) If a person has obtained information in the course of performing an Auditor‑General function, the person must not disclose the information except in the course of performing an Auditor‑General function or for the purpose of any Act that gives functions to the Auditor‑General. Penalty: Imprisonment for 2 years. > Note: Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility. (2) Subsection (1) does not prevent the Auditor‑General from disclosing particular information to the Commissioner of the Australian Federal Police if the Auditor‑General is of the opinion that the disclosure is in the public interest. (2A) Subsection (1) does not prevent a person (the information holder) from disclosing information to another person under section 23A if the information holder does so in the circumstances permitted by that section. (2B) A person commits an offence if: (a) information is disclosed to the person; and (b) the information is disclosed in circumstances permitted by section 23A; and (c) the information is not disclosed to the person because the person is performing an Auditor‑General function; and (d) the person uses or discloses the information. Penalty: Imprisonment for 2 years. > Note: Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility. (2C) Subsection (2B) does not apply if the Auditor‑General has consented to the use or disclosure. > Note: A defendant bears an evidential burden in relation to a matter in subsection (2C): see subsection 13.3(3) of the Criminal Code. (3) A person commits an offence if: (a) the person receives any of the following: (i) a proposed report (including a draft) under section 19; (ii) any other report (including a draft) created for the purposes of preparing a proposed report under section 19; (iii) an extract from a report referred to in this paragraph; and (b) the person discloses any information in the report or extract. Penalty: Imprisonment for 2 years. (4) Subsection (3) does not apply if the Auditor‑General has consented to the disclosure. > Note: A defendant bears an evidential burden in relation to a matter in subsection (4): see subsection 13.3(3) of the Criminal Code.