56Secrecy—general obligations

56 Secrecy—general obligations (1) In this section: body regulated by APRA includes a body that has at any time been a body regulated by APRA. court includes a tribunal, authority or person having the power to require the production of documents or the answering of questions. Financial Regulator Assessment Authority official means an entrusted person within the meaning of the Financial Regulator Assessment Authority Act 2021. financial sector entity has the same meaning as in the Financial Sector (Collection of Data) Act 2001. officer means: (a) an APRA member; or (b) an APRA staff member; or (c) any other person who, because of his or her employment, or in the course of that employment: (i) has acquired protected information; or (ii) has had access to protected documents; other than an employee of the body to which the information or document relates. personal information has the same meaning as in the Privacy Act 1988. produce includes permit access to. protected document means a document given or produced (whether before or after the commencement of this section) under, or for the purposes of, a prudential regulation framework law and containing information relating to the affairs of: (a) a financial sector entity; or (b) a body corporate (including a body corporate that has ceased to exist) that has at any time been, or is, related (within the meaning of the Corporations Act 2001) to a body regulated by APRA or to a registered entity; or (c) a person who has been, is, or proposes to be, a customer of a body regulated by APRA or of a registered entity; or (ca) a person in relation to whom information is, or was, required to be given under a reporting standard made in accordance with subsection 13(4A) or (4D) of the Financial Sector (Collection of Data) Act 2001; or (cc) a person in relation to whom information is, or was, required to be given under the Financial Accountability Regime Act 2023; other than: (d) a document containing information that has already been lawfully made available to the public from other sources; or (da) a document given or produced to ASIC under, or for the purposes of, a provision of the Financial Accountability Regime Act 2023, other than a document given or produced to ASIC by APRA; or (e) a document given or produced under, or for the purposes of, a provision of the Superannuation Industry (Supervision) Act 1993: (i) administered by the Commissioner of Taxation; or (ii) being applied for the purposes of the administration of a provision administered by the Commissioner of Taxation. It also includes a document that is given to APRA under Part 7.5A of the Corporations Act 2001, other than a document containing information that has already been lawfully made available to the public from other sources. protected information means information disclosed or obtained (whether before or after the commencement of this section) under, or for the purposes of, a prudential regulation framework law and relating to the affairs of: (a) a financial sector entity; or (b) a body corporate (including a body corporate that has ceased to exist) that has at any time been, or is, related (within the meaning of the Corporations Act 2001) to a body regulated by APRA or to a registered entity; or (c) a person who has been, is, or proposes to be, a customer of a body regulated by APRA or of a registered entity; or (ca) a person in relation to whom information is, or was, required to be given under a reporting standard made in accordance with subsection 13(4A) or (4D) of the Financial Sector (Collection of Data) Act 2001; or (cc) a person in relation to whom information is, or was, required to be given under the Financial Accountability Regime Act 2023; other than: (d) information that has already been lawfully made available to the public from other sources; or (da) information given or produced to ASIC under, or for the purposes of, a provision of the Financial Accountability Regime Act 2023, other than information given or produced to ASIC by APRA; or (e) information given or produced under, or for the purposes of, a provision of the Superannuation Industry (Supervision) Act 1993: (i) administered by the Commissioner of Taxation; or (ii) being applied for the purposes of the administration of a provision administered by the Commissioner of Taxation. It also includes information that is given to APRA under Part 7.5A of the Corporations Act 2001, other than information that has already been lawfully made available to the public from other sources. registered entity means a corporation that is, or has at any time been, a registered entity within the meaning of the Financial Sector (Collection of Data) Act 2001. (2) A person who is or has been an officer commits an offence if: (a) the person directly or indirectly: (i) discloses information acquired in the course of his or her duties as an officer to any person or to a court; or (ii) produces a document to any person or to a court; and (b) the information is protected information, or the document is a protected document; and (c) the disclosure or production is not in accordance with subsection (3), (4), (5), (5AA), (5A), (5AB), (5AC), (5B), (5C), (5D), (6), (6AA), (6AB), (6A), (7), (7A), (7B), (7C), (7G), (7H), (7J), (7K) or (7L). Penalty: Imprisonment for 2 years. Note: Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility. (3) It is not an offence if the disclosure of protected information or the production of a protected document by a person is for the purposes of a prudential regulation framework law. Note: A defendant bears an evidential burden in relation to the matters in subsection (3) (see subsection 13.3(3) of the Criminal Code). (4) It is not an offence if the disclosure of protected information or the production of a protected document by a person: (a) is by an employee of the person to whose affairs the information or document relates; or (b) occurs after the person to whose affairs the information or document relates has agreed in writing to the disclosure or production. Note: A defendant bears an evidential burden in relation to the matters in subsection (4) (see subsection 13.3(3) of the Criminal Code). (5) It is not an offence if the disclosure of protected information or the production of a protected document by a person: (a) occurs when the person is satisfied that the disclosure of the information, or the production of the document, will assist a financial sector supervisory agency, or any other agency (including foreign agencies) specified in the regulations, to perform its functions or exercise its powers and the disclosure or production is to that agency; or (aa) occurs when the person is satisfied that the disclosure of the information, or the production of the document, will assist the operator of the AFCA scheme (within the meaning of the Corporations Act 2001) to perform its functions or exercise its powers, and the disclosure or production is to that operator; or (b) is to another person and is approved by APRA by instrument in writing. Note: A defendant bears an evidential burden in relation to the matters in subsection (5) (see subsection 13.3(3) of the Criminal Code). (5AA) It is not an offence if the disclosure of protected information or the production of a protected document is made: (a) by an officer of an agency to which the information or document has been disclosed or produced under paragraph (5)(a); and (b) for the same purpose as the information or document was so disclosed or produced to that agency. Note: A defendant bears an evidential burden in relation to the matters in subsection (5AA) (see subsection 13.3(3) of the Criminal Code). (5A) It is not an offence if the production by a person of a document that was given to APRA under section 9 or 13 of the Financial Sector (Collection of Data) Act 2001 is to the Australian Statistician for the purposes of the Census and Statistics Act 1905. Note: A defendant bears an evidential burden in relation to matters in subsection (5A) (see subsection 13.3(3) of the Criminal Code). (5AB) It is not an offence if the disclosure of protected information or the production of a protected document by a person is for the purpose of APRA complying with any of the following: (a) section 55B (ASIC requests); (b) section 55D (Notifying ASIC of reasonable belief of material breach of ASIC provisions). Note: A defendant bears an evidential burden in relation to the matters in subsection (5AB) (see subsection 13.3(3) of the Criminal Code). (5AC) It is not an offence if: (a) the disclosure of protected information or the production of a protected document is by ASIC, for the purposes of the performance of ASIC’s functions, or the exercise of ASIC’s powers; and (b) the protected information was disclosed previously to ASIC, or the protected document was produced previously to ASIC, for the purpose of APRA complying with any of the following: (i) section 55B (ASIC requests); (ii) section 55D (Notifying ASIC of reasonable belief of material breach of ASIC provisions). Note: A defendant bears an evidential burden in relation to the matters in subsection (5AC) (see subsection 13.3(3) of the Criminal Code). (5B) It is not an offence if the production by a person of a document that was given to APRA under section 9 or 13 of the Financial Sector (Collection of Data) Act 2001 is to: (a) the Reserve Bank of Australia; or (b) another prescribed authority. Note: A defendant bears an evidential burden in relation to matters in subsection (5B) (see subsection 13.3(3) of the Criminal Code). (5C) If: (a) a document is a reporting document given to APRA under section 13 of the Financial Sector (Collection of Data) Act 2001; and (b) either: (i) a determination has been made under section 57 that the document does not, or documents of that kind do not, contain confidential information; or (ii) a determination has been made under section 57 that a specified part of the document, or of documents of that kind, does not contain confidential information; it is not an offence to disclose the document or that part of the document, or any information contained in the document or that part of the document, to any person (including by making the document, the part of the document or the information available on APRA’s website). (5D) It is not an offence if the production by a person of a document that was given to APRA under section 13 of the Financial Sector (Collection of Data) Act 2001 is to the Commissioner of Taxation for the purposes of the Major Bank Levy Act 2017 (including the administration of that Act). Note: A defendant bears an evidential burden in relation to matters in subsection (5D) (see subsection 13.3(3) of the Criminal Code). (6) It is not an offence if the disclosure of protected information or the production of a protected document is to: (a) an APRA member; or (b) an APRA staff member; for the purposes of the performance of APRA’s functions, or the exercise of APRA’s powers, under a law of the Commonwealth or of a State or a Territory. Note: A defendant bears an evidential burden in relation to the matters in subsection (6) (see subsection 13.3(3) of the Criminal Code). (6AA) It is not an offence if the disclosure of protected information or the production of a protected document is to a Financial Regulator Assessment Authority official for the purposes of the performance of the Financial Regulator Assessment Authority’s functions or the exercise of the Financial Regulator Assessment Authority’s powers. Note: A defendant bears an evidential burden in relation to the matters in subsection (6AA) (see subsection 13.3(3) of the Criminal Code). (6AB) It is not an offence if: (a) the disclosure of protected information or the production of a protected document is by a person who is or has been a Financial Regulator Assessment Authority official; and (b) the person acquired the information or accessed the document in the course of the person’s duties in relation to the Financial Regulator Assessment Authority. Note 1: A defendant bears an evidential burden in relation to the matters in subsection (6AB) (see subsection 13.3(3) of the Criminal Code). Note 2: Division 3 of Part 4 of the Financial Regulator Assessment Authority Act 2021 deals with disclosure of information by Financial Regulator Assessment Authority officials. (6A) It is not an offence if the disclosure of protected information or the production of a protected document is to: (a) an auditor who has provided, or is providing, professional services to a general insurer, authorised NOHC or a subsidiary of a general insurer or authorised NOHC; or (b) an actuary who has provided, or is providing, professional services to a general insurer, authorised NOHC or a subsidiary of a general insurer or authorised NOHC; and the disclosure is for the purposes of the performance of APRA’s functions, or the exercise of APRA’s powers, under a law of the Commonwealth or of a State or Territory. (7) It is not an offence if the information, or the information contained in the document, as the case may be, is in the form of a summary or collection of information that is prepared so that information relating to any particular person cannot be found out from it. Note: A defendant bears an evidential burden in relation to the matters in subsection (7) (see subsection 13.3(3) of the Criminal Code). (7A) It is not an offence if the information, or the information contained in the document, as the case may be, is all or any of the following: (a) the names of bodies that are regulated by APRA; (b) the addresses at which bodies referred to in paragraph (a) conduct business; (c) any other information that is reasonably necessary to enable members of the public to contact persons who perform functions in relation to bodies referred to in paragraph (a). Note: A defendant bears an evidential burden in relation to the matters in subsection (7A) (see subsection 13.3(3) of the Criminal Code). (7B) It is not an offence if the information, or the information contained in the document, as the case may be, is: (a) a statement of APRA’s opinion as to whether or not a body regulated by APRA is complying, or was complying at a particular time, with a particular provision of a prudential regulation framework law; or (b) a description of: (i) court proceedings in relation to a breach or suspected breach by a person of a provision of a prudential regulation framework law; or (ii) activity engaged in, or proposed to be engaged in, by APRA in relation to such a breach or suspected breach; or (c) a description of action under a prudential regulation framework law that APRA has taken or is proposing to take in relation to: (i) a body regulated by APRA; or (ii) an individual who holds or has held a position with or in relation to such a body. Note: A defendant bears an evidential burden in relation to the matters in subsection (7B) (see subsection 13.3(3) of the Criminal Code). (7C) If information referred to in subsection (7A) or paragraph (7B)(a) that relates to a body that is, or has at any time been, regulated by APRA under the Superannuation Industry (Supervision) Act 1993 is disclosed to the Registrar of the Australian Business Register established under section 24 of the A New Tax System (Australian Business Number) Act 1999, the Registrar may enter the information in that Register. Note: A defendant bears an evidential burden in relation to the matters in subsection (7C) (see subsection 13.3(3) of the Criminal Code). (7G) It is not an offence if: (a) the disclosure of protected information or the production of a protected document is to an accountable entity (within the meaning of the Financial Accountability Regime Act 2023); and (b) the information, or the information contained in the document, as the case may be, is information contained in the register kept under section 40 of the Financial Accountability Regime Act 2023. Note: A defendant bears an evidential burden in relation to the matters in subsection (7G) (see subsection 13.3(3) of the Criminal Code). (7H) It is not an offence if: (a) the disclosure of protected information or the production of a protected document is to an individual; and (b) the information, or the information contained in the document, as the case may be, is only personal information about the individual; and (c) the information, or the information contained in the document, as the case may be, is information contained in the register kept under section 40 of the Financial Accountability Regime Act 2023. Note: A defendant bears an evidential burden in relation to the matters in subsection (7H) (see subsection 13.3(3) of the Criminal Code). (7J) It is not an offence if: (a) the disclosure of protected information or the production of a protected document is by APRA; and (b) the information, or the information contained in the document, as the case may be, is information that discloses: (i) whether a person is disqualified under section 42 of the Financial Accountability Regime Act 2023; or (ii) a decision made under Division 2 of Part 3 of Chapter 3 of that Act (which is about disqualification of accountable persons), or the reasons for such a decision. Note: A defendant bears an evidential burden in relation to the matters in subsection (7J) (see subsection 13.3(3) of the Criminal Code). (7K) It is not an offence if the disclosure of protected information or the production of a protected document by a person is in accordance with section 39 of the Financial Accountability Regime Act 2023. Note: A defendant bears an evidential burden in relation to the matters in subsection (7K) (see subsection 13.3(3) of the Criminal Code). (7L) It is not an offence if: (a) the disclosure of protected information or the production of a protected document is by ASIC, for the purposes of the performance of ASIC’s functions, or the exercise of ASIC’s powers; and (b) the protected information was disclosed previously to ASIC, or the protected document was produced previously to ASIC, in accordance with section 39 of the Financial Accountability Regime Act 2023. Note: A defendant bears an evidential burden in relation to the matters in subsection (7L) (see subsection 13.3(3) of the Criminal Code). (8) A person who is, or has been, an officer cannot be required to disclose to a court any protected information, or to produce in a court a protected document, except when it is necessary to do so for the purposes of a prudential regulation framework law. (8A) However, subsection (8) does not prevent a person who is, or has been, a Financial Regulator Assessment Authority official from being required to disclose, or produce a document containing, protected information (within the meaning of the Financial Regulator Assessment Authority Act 2021) when it is necessary to do so for the purposes of that Act. (9) If a person discloses information or produces a document under this section to another person, the first person may, at the time of the disclosure, impose conditions to be complied with in relation to the information disclosed or the document produced. (9A) Subsection (9) does not apply if the information is disclosed, or the document is produced, in accordance with subsection (6AA) or (6AB). (9B) Subsection (9) does not apply if the information is disclosed, or the document is produced, in accordance with subsection (5AB) or (5AC). (10) A person commits an offence if the person fails to comply with a condition imposed under subsection (9). Penalty: Imprisonment for 2 years. Note: Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility. (11) A document that: (a) is a protected document; or (b) contains protected information; is an exempt document for the purposes of section 38 of the Freedom of Information Act 1982. Note: For additional rules about personal information, see the Privacy Act 1988. (12) A disclosure of personal information is taken to be authorised by this Act for the purposes of paragraph 6.2(b) of Australian Privacy Principle 6 if: (a) the information is protected information and the disclosure is made in accordance with any of subsections (4), (5), (5AA), (5AB), (5AC), (6), (6AA), (7A), (7B), (7C), (7G), (7H), (7J), (7K) and (7L); or (b) the information is contained in a protected document and the disclosure is made by the production of the document in accordance with any of those subsections.