16Disclosure framework

16 Disclosure framework

(1) The Registrar may, by legislative instrument, make a disclosure framework relating to disclosing protected information. (2) Without limiting subsection (1), the disclosure framework may provide for any of the following: (a) circumstances in which protected information must not be disclosed without the consent of the person to whom it relates; (b) circumstances in which de‑identified protected information may be disclosed; (c) circumstances in which protected information may be disclosed to the general public; (d) circumstances in which confidentiality agreements are required for the disclosure of protected information; (e) imposing conditions on disclosure of protected information. (3) Without limiting subsection (1), the disclosure framework may provide differently in relation to different functions or powers of the Registrar. (4) A person commits an offence if: (a) the person is a party to a confidentiality agreement of a kind mentioned in paragraph (2)(d); and (b) the person fails to comply with the confidentiality agreement.

Penalty: 100 penalty units or imprisonment for 2 years, or both.

(5) The disclosure framework must not provide for disclosure of protected information unless the Registrar is satisfied that the benefits of the disclosure would outweigh the risks of the disclosure (taking into account any mitigation of those risks in accordance with the disclosure framework). (6) However, subsection (5) does not apply to the extent that the disclosure framework deals with a matter in accordance with a direction under section 9. (7) If: (a) a Commonwealth body (the new Registrar) is appointed as the Registrar with particular functions or powers; and (b) immediately before that appointment, another Commonwealth body was the Registrar with those functions or powers; and (c) the new Registrar does not have a disclosure framework that would apply to those functions or powers; the disclosure framework applying to those functions or powers immediately before that appointment continues to apply until the new Registrar makes a disclosure framework that applies to those functions or powers, or amends its existing disclosure framework to apply to those functions or powers.