29Unauthorised dealing with information

29 Unauthorised dealing with information

(1) A person commits an offence if: (a) the person makes a record of, discloses or otherwise uses information; and (b) the information was acquired by the person in the course of performing functions or exercising powers conferred for the purposes of an information commissioner function, a freedom of information function or a privacy function.

Penalty: Imprisonment for 2 years.

Note: Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility.

(2) This section does not apply if: (a) both of the following apply: (i) the information was acquired by the person in the course of performing an information commissioner function or exercising a related power; (ii) the person records, discloses or otherwise uses the information in the course of performing an information commissioner function or exercising a related power; or (aa) both of the following apply: (i) the information was acquired by the person in the course of performing a freedom of information function or exercising a related power; (ii) the person records, discloses or otherwise uses the information in the course of performing a freedom of information function or exercising a related power; or (ab) both of the following apply: (i) the information was acquired by the person in the course of performing a privacy function or exercising a related power; (ii) the person records, discloses or otherwise uses the information in the course of performing a privacy function or exercising a related power; or (ac) for information covered by subsection (5)—the person records, discloses or otherwise uses the information in the course of any of the following: (i) performing a function described in paragraph 9(1)(b), or exercising a related power; (ii) providing information to the Minister or the Department; (iii) providing information to the Minister administering Part IVD of the Competition and Consumer Act 2010 or the Department administered by that Minister; (iv) providing information to the Australian Competition and Consumer Commission or the Data Recipient Accreditor (within the meaning of that Act); or (b) the person acquires the information for any other lawful purpose; or (c) the person to whom the information relates consents to the recording, disclosure or use of the information; or (d) the person: (i) records or otherwise uses the information for the purpose of an IGIS official exercising a power, or performing a function or duty, as an IGIS official; or (ii) discloses the information to an IGIS official for the purpose of the IGIS official exercising a power, or performing a function or duty, as an IGIS official.

Note: A defendant bears an evidential burden in relation to the matters in subsection (2) (see subsection 13.3(3) of the Criminal Code).