56BNMisleading or deceptive conduct—offence

56BN Misleading or deceptive conduct—offence

(1) A person commits an offence if:

(a) the person engages in conduct; and

(b) the person does so knowing that the conduct:

(i) is misleading or deceptive; or

(ii) is likely to be misleading or deceptive; and

(c) the conduct misleads or deceives, or is likely to mislead or deceive, another person (the second person) into believing that:

(i) a person is a CDR consumer for CDR data; or

(ii) a person is making a valid request or consent, or has satisfied other criteria, for the disclosure of CDR data under the consumer data rules; or

(iii) a person is a CDR consumer for a CDR action; or

(iv) a person has satisfied any criteria under the consumer data rules for the making of a request, the giving of a valid instruction, or the processing of a valid instruction, for the performance of a CDR action.

Note: The person mentioned in subparagraph (c)(i), (ii), (iii) or (iv) could be the first‑mentioned person, the second person or a third person.

Defence

(2) Subsection (1) does not apply if the conduct is not misleading or deceptive in a material particular.

Note: A defendant bears an evidential burden in relation to the matter in this subsection (see subsection 13.3(3) of the Criminal Code).

Penalty—body corporate

(3) An offence against subsection (1) committed by a body corporate is punishable on conviction by a fine of not more than the greater of the following:

(a) $10,000,000;

(b) if the court can determine the value of the benefit that the body corporate, and any body corporate related to the body corporate, have obtained directly or indirectly and that is reasonably attributable to the commission of the offence—3 times the value of that benefit;

(c) if the court cannot determine the value of that benefit—10% of the adjusted turnover of the body corporate during the 12‑month period ending at the end of the month in which the commission of the offence happened or began.

Penalty—other persons

(5) An offence against subsection (1) committed by a person other than a body corporate is punishable on conviction by imprisonment for not more than 5 years, a fine of not more than $500,000, or both.