29Unauthorised dealing with information

#### 29 Unauthorised dealing with information (1) A person commits an offence if: (a) the person makes a record of, discloses or otherwise uses information; and (b) the information was acquired by the person in the course of performing functions or exercising powers conferred for the purposes of an information commissioner function, a freedom of information function or a privacy function. Penalty: Imprisonment for 2 years. > Note: Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility. (2) This section does not apply if: (a) both of the following apply: (i) the information was acquired by the person in the course of performing an information commissioner function or exercising a related power; (ii) the person records, discloses or otherwise uses the information in the course of performing an information commissioner function or exercising a related power; or (aa) both of the following apply: (i) the information was acquired by the person in the course of performing a freedom of information function or exercising a related power; (ii) the person records, discloses or otherwise uses the information in the course of performing a freedom of information function or exercising a related power; or (ab) both of the following apply: (i) the information was acquired by the person in the course of performing a privacy function or exercising a related power; (ii) the person records, discloses or otherwise uses the information in the course of performing a privacy function or exercising a related power; or (ac) for information covered by subsection (5)—the person records, discloses or otherwise uses the information in the course of any of the following: (i) performing a function described in paragraph 9(1)(b), or exercising a related power; (ii) providing information to the Minister or the Department; (iii) providing information to the Minister administering Part IVD of the Competition and Consumer Act 2010 or the Department administered by that Minister; (iv) providing information to the Australian Competition and Consumer Commission or the Data Recipient Accreditor (within the meaning of that Act); or (b) the person acquires the information for any other lawful purpose; or (c) the person to whom the information relates consents to the recording, disclosure or use of the information; or (d) the person: (i) records or otherwise uses the information for the purpose of an IGIS official exercising a power, or performing a function or duty, as an IGIS official; or (ii) discloses the information to an IGIS official for the purpose of the IGIS official exercising a power, or performing a function or duty, as an IGIS official. > Note: A defendant bears an evidential burden in relation to the matters in subsection (2) (see subsection 13.3(3) of the Criminal Code). (3) A person to whom this section applies must not be required to do either of the following unless that disclosure or production is necessary for the purposes of this Act: (a) disclose to a court information that the person acquired in the course of performing functions or exercising powers under this Act for the purposes of another Act (or an instrument under another Act) that confers an information commissioner function, a freedom of information function or a privacy function; (b) produce all or part of a document that contains information of that kind to a court. (4) For the purposes of subsection (3), court includes any tribunal, authority or person having power to require the production of documents or the answering of questions. (5) This subsection covers information that: (a) was acquired in the course of performing a function described in paragraph 9(1)(b) (about the consumer data right), or exercising a related power; or (b) could be relevant to either of the following decisions: (i) a decision under subsection 56CA(1) (about accreditation for the consumer data right) of the Competition and Consumer Act 2010; (ii) a decision under the consumer data rules (within the meaning of that Act) relating to a person’s accreditation under subsection 56CA(1) of that Act. (6) In this Act: > IGIS official means: (a) the Inspector‑General of Intelligence and Security; or (b) any other person covered by subsection 32(1) of the Inspector‑General of Intelligence and Security Act 1986.