59ABDisclosing information to private sector bodies

#### 59AB Disclosing information to private sector bodies (1) The CEO may disclose ACC information to a body corporate that is prescribed, or is included in a class of bodies corporate that is prescribed, by the regulations for the purposes of this section if: (a) the CEO considers it appropriate to do so; and (b) the CEO considers that disclosing the information to the body is necessary for a permissible purpose; and (c) the body has undertaken, in writing, not to use or further disclose the information except: (i) as referred to in subsection (3); or (ii) as required by a law of the Commonwealth, a State or a Territory; and (d) the body has undertaken, in writing, to comply with any conditions the CEO specifies under subsection (4) or (5); and (e) disclosing the ACC information would not prejudice: (i) a person’s safety; or (ii) a person’s fair trial if the person has been charged with an offence or such a charge is imminent; and (f) disclosing the ACC information would not be contrary to a law of the Commonwealth, a State or Territory that would otherwise apply. Limitations on disclosing information under subsection (1) (2) The CEO may disclose ACC information to a body corporate under subsection (1) only if: (a) for information that is personal information (within the meaning of the Privacy Act 1988)—the CEO considers that disclosing the information is necessary for the purposes of: (i) preventing criminal offences or activities that might constitute criminal offences (including under a law of a foreign country); or (ii) detecting criminal offences or activities that might constitute criminal offences (including under a law of a foreign country); or (iii) facilitating the collection of criminal information and intelligence in relation to criminal offences or activities that might constitute criminal offences (including under a law of a foreign country); and (b) in any case—the information is not confidential commercial information relating to another body or person. (2A) In deciding whether to disclose national policing information under subsection (1), the CEO must act in accordance with any policy determined, and any direction given, in writing by the Board. (2B) The CEO must obtain the approval of the Board before disclosing national policing information under subsection (1). Specifying purposes and conditions etc. (3) The CEO must specify, in writing, any permissible purpose for which the ACC information may be used or further disclosed. (4) If the CEO discloses ACC information that is personal information (within the meaning of the Privacy Act 1988) to a body corporate, the CEO must specify, in writing: (a) one or more conditions that the body corporate must meet in relation to monitoring and controlling any further disclosure of that information by an employee or officer of the body corporate; and (b) a condition that the information is not to be disclosed to a person who is not an employee or officer of the body corporate, other than in any circumstances specified; and (c) one or more conditions that the body corporate must meet in order to ensure that the information is not used or disclosed in a way that might prejudice the reputation of a person. (5) The CEO may specify, in writing, any other conditions that the CEO considers appropriate in relation to ACC information that is disclosed under, or in accordance with, this section (whether in relation to personal information or any other ACC information). (6) An instrument made under subsection (3), (4) or (5) is not a legislative instrument. Offence—disclosure etc. for unauthorised purposes (7) A person commits an offence if: (a) ACC information is disclosed to the person under, or in accordance with, this section; and (b) the person (directly or indirectly): (i) makes a record of the information; or (ii) discloses the information to any other person; and (c) the record or disclosure referred to in paragraph (b) is not: (i) for a purpose specified under subsection (3) in relation to the information; or (ii) required by any other law. Penalty: Imprisonment for 2 years or 120 penalty units, or both. Offence—breach of conditions (8) A person commits an offence if: (a) ACC information is disclosed to the person under, or in accordance with, this section; and (b) the CEO specifies a condition under subsection (4) or (5) in relation to the information; and (c) the person does an act or omits to do an act in relation to the information; and (d) the act or omission breaches the condition. Penalty: Imprisonment for 2 years or 120 penalty units, or both. Defence—information legitimately made public (9) Subsections (7) and (8) do not apply to a person in relation to ACC information if: (a) the information is in the public domain before the person: (i) makes the record, or discloses the information (if subsection (7) applies); or (ii) does the act or omits to do the act in relation to the information (if subsection (8) applies); and (b) the original disclosure of the information into the public domain (before the person does the thing referred to in subparagraph (a)(i) or (ii) of this subsection) was not: (i) in contravention of section 51 or subsection (7) or (8) of this section; or (ii) in breach of an undertaking given under subsection (1) of this section. > Note: A defendant bears an evidential burden in relation to the matter in subsection (9) (see subsection 13.3(3) of the Criminal Code).