16Prohibition of disclosure of certain information

#### 16 Prohibition of disclosure of certain information Overview (1) This section: (a) prohibits the unauthorised recording and disclosure of certain information held by the Australian Customs and Border Protection Service; and (b) provides for exceptions in relation to the prohibition; and (c) makes particular provision in relation to the authorised disclosure of personal information. Persons to whom section applies (1AA) This section applies to: (a) the CEO; and (b) a person performing duties in the Australian Customs and Border Protection Service as a person employed or engaged by the Commonwealth, a Commonwealth agency, a State or a State agency; and (c) any of the following persons: (i) a person engaged to provide goods or services to the Commonwealth through the Australian Customs and Border Protection Service (whether or not under an agreement to which the Commonwealth is a party); (ii) if the person mentioned in subparagraph (i) is a body corporate—a director, an employee or an agent of the body corporate; (iii) if the person mentioned in subparagraph (i) is an individual—an employee or agent of the individual; and (d) a person to whom the CEO has delegated a power or function of the CEO under a law of customs or any other law of the Commonwealth; and (e) a person authorised by the CEO to exercise a power or function under a law of customs or any other law of the Commonwealth. Definitions (1A) In this section: > Commonwealth agency means any instrumentality or agency of the Crown in right of the Commonwealth and includes: (a) a department of the public service of the Commonwealth; and (b) any body corporate in which the Commonwealth holds a controlling interest; but does not include a Minister of the Crown in right of the Commonwealth. > duties, in relation to a person, means the duties of the person in the capacity because of which he or she is a person to whom this section applies and only includes such duties that are performed in or in connection with the Australian Customs and Border Protection Service. > Note: Example: In the case of a person who is employed by a State agency, the person’s duties, for the purposes of this section, include only those duties performed in or in connection with the Australian Customs and Border Protection Service as such an employee and does not include the person’s other duties as an employee of that State agency. > international organisation means: (a) an international organisation within the meaning of the Diplomatic Privileges and Immunities Act 1967; and (b) any other international organisation prescribed by the regulations for the purposes of this paragraph. > personal information has the same meaning as in the Privacy Act 1988. > principal officer, in relation to a Commonwealth agency or a State agency, means: (a) if the agency is constituted by one person—that person; and (b) if the agency is constituted by more than one person—the person who is entitled to preside at any meeting of the agency at which he or she is present; and (c) in any other case—the person holding, or performing the duties of, the office of the head of that agency. > protected information means information that directly or indirectly comes to the knowledge of, or into the possession of, a person while he or she is performing his or her duties (whether the information is related to those duties or not). > State includes the Australian Capital Territory, the Northern Territory and Norfolk Island. > State agency means any instrumentality or agency of the Crown in right of a State, and includes a department of the public service of the State and any body corporate in which the State holds a controlling interest, but does not include a Minister of the Crown in right of the State, a municipal corporation or any other local government body. Prohibition against disclosure etc. of protected information (2) A person who is or has been a person to whom this section applies must not directly or indirectly: (a) make a record of any protected information; or (b) disclose to any person any protected information; except: (c) as authorised by this section; or (ca) for the purposes of the Law Enforcement Integrity Commissioner Act 2006 or regulations under that Act; or (d) as required or authorised by any other law; or (e) in the course of performing the person’s duties. Penalty: Imprisonment for 2 years. Authorised disclosure under this section (3) Subject to subsections (7), (8) and (10), a person is authorised by this section to carry out an act referred to in paragraph (2)(a) or (b) if it is carried out: (a) in accordance with an authorisation by the CEO that is referred to in subsection (3A), (3B), (3C) or (3D); or (b) as provided in subsection (3F), (3G) or (3H). CEO’s authorisation—Commonwealth agency (3A) Subject to subsections (3E), (7), (8) and (10), if the CEO is satisfied that: (a) information or a class of information held by the Australian Customs and Border Protection Service will be used by a Commonwealth agency for the purposes of that agency’s functions; and (b) the Commonwealth agency has undertaken not to use or further disclose such information or class of information except for the purpose referred to in paragraph (d) or otherwise as required or authorised by law; the CEO may in writing: (c) authorise the disclosure by a person of the information or the class of information to the principal officer of, or a person authorised to act on behalf of, that agency; and (d) specify the purpose for which the disclosure is authorised to be made and the manner in which, or the conditions under which, the disclosure is to be made (including the form in which the information is to be presented and the mode of transmitting that information). CEO’s authorisation—State agency for Commonwealth purposes (3B) Subject to subsections (3E), (7), (8) and (10), if the CEO is satisfied that: (a) information or a class of information held by the Australian Customs and Border Protection Service will be used by a State agency for purposes relating to the carrying out of a Commonwealth function by that agency; and (b) the State agency has undertaken not to use or further disclose such information or class of information except for the purpose referred to in paragraph (d) or otherwise as required or authorised by law; the CEO may in writing: (c) authorise the disclosure by a person of the information or the class of information to the principal officer of, or a person authorised to act on behalf of, that agency; and (d) specify the purpose for which the disclosure is authorised to be made and the manner in which, or the conditions under which, the disclosure is to be made (including the form in which the information is to be presented and the mode of transmitting that information). CEO’s authorisation—State agency for State purposes (3C) Subject to subsections (3E), (7), (8) and (10), if the CEO is satisfied that: (a) information or a class of information held by the Australian Customs and Border Protection Service will be used by a State agency for the purposes of the performance of the functions of the State agency; and (b) the State agency has undertaken not to use or further disclose such information or class of information except for the purpose referred to in paragraph (d) or otherwise as required or authorised by law; the CEO may in writing: (c) authorise the disclosure by a person of the information or the class of information to the principal officer of, or a person authorised to act on behalf of, that agency; and (d) specify the purpose for which the disclosure is authorised to be made and the manner in which, or the conditions under which, the disclosure is to be made (including the form in which the information is to be presented and the mode of transmitting that information). CEO’s authorisation—certain agreements (3D) Subject to subsections (3E), (7), (8) and (10), if the CEO is satisfied that: (a) information or a class of information held by the Australian Customs and Border Protection Service will be used in accordance with an agreement that has been entered into by the Commonwealth or a Commonwealth agency and one or more of any of the following: (i) a foreign country; (ii) an instrumentality or agency of a foreign country; (iii) an international organisation; and (b) the country, instrumentality, agency or organisation has undertaken not to use or further disclose that information except for the purpose referred to in paragraph (d) or otherwise as required or authorised by law; the CEO may in writing: (c) authorise the disclosure by a person of the information or the class of the information to a person authorised to act on behalf of that country, instrumentality, agency or organisation; and (d) specify the purpose for which the disclosure is authorised to be made and the manner in which, or the conditions under which, the disclosure is to be made (including the form in which the information is to be presented and the mode of transmitting that information). Specified purpose in an authorisation by the CEO (3E) The CEO may only specify a purpose for the disclosure of information or a class of information in an authorisation under subsection (3A), (3B), (3C) or (3D) that: (a) in the case of subsection (3A)—is related to the performance of the functions of the Commonwealth agency concerned; and (b) in the case of subsection (3B)—is related to the performance of the Commonwealth function concerned; and (c) in the case of subsection (3C)—is related to the performance of the functions of the State agency concerned; and (d) in the case of subsection (3D)—is related to the purpose of the agreement concerned. > Note: The obligations under subsection (3E) is affected by paragraph (8)(b) if the information concerned contains personal information. Authorised disclosure because of threat to health or life (3F) A person may carry out an act referred to in paragraph (2)(a) or (b) if there are reasonable grounds for that person to believe that: (a) a serious and imminent threat to the health or life of a person or persons exists or might exist; and (b) it is necessary to carry out that act in order to avert or reduce that threat. Body corporate may consent to disclosure (3G) If the CEO is satisfied that the principal officer of, or a person authorised to act on behalf of, a body corporate has consented to the disclosure to a person of information or a class of information (not including personal information) about the body, the CEO may authorise, in writing, the disclosure of the information to the person. Government agencies, foreign countries or international organisations may consent to disclosure (3H) If the CEO is satisfied that a Commonwealth agency, State agency, a foreign country, an instrumentality or agency of a foreign country or an international organisation has consented to the disclosure to a person of information or a class of information (not including personal information) about the agency, country, instrumentality or organisation, the CEO may authorise, in writing, the disclosure of the information to the person. Disclosure of personal information (7) If: (a) apart from this subsection, a person is authorised by this section to carry out an act referred to in paragraph (2)(b) because of the operation of subsection (3A), (3B), (3C) or (3D); and (b) the act involves the disclosure by the person to someone else of information (including a class of information) that contains personal information; then, despite the above provisions of this section, the person is not to be taken to be authorised by this section to carry out the act unless: (c) the person to whom the information relates has consented to the disclosure; or (d) the following apply: (i) in the case of any disclosure of information—the disclosure complies with subsection (8); (ii) in the case of a disclosure of a class of information—the disclosure also complies with subsection (10). Requirements applicable to disclosure of personal information (8) This subsection is complied with in relation to the disclosure of information as referred to in subparagraph (7)(d)(i) if: (a) the CEO is satisfied that the disclosure is necessary for a permissible purpose referred to in a paragraph of subsection (9); and (b) the purpose is specified as a purpose for which the disclosure is authorised to be made in an authorisation under subsection (3A), (3B), (3C) or (3D) that applies to the disclosure; and (c) the disclosure is made for that purpose. Permissible purposes (9) A purpose specified in any of the following paragraphs is a permissible purpose for the purpose of subsection (8): (a) the administration or enforcement of a law of the Commonwealth, of a Territory or of another country that relates to: (i) criminal law; or (ii) a law imposing a pecuniary penalty or providing for the forfeiture of property; (b) in relation to a law referred to in paragraph (a), the prevention of crime, or the detection or analysis of criminal conduct, in respect of that law; (c) the administration or enforcement of a law of a State that relates to: (i) criminal law; or (ii) a law imposing a pecuniary penalty or providing for the forfeiture of property; (d) in relation to a law referred to in paragraph (c), the prevention of crime, or the detection or analysis of criminal conduct, in respect of that law; (e) a purpose relating to the protection of public health, or the prevention or elimination of risks to the life or safety of an individual or a group of individuals; (ea) the collection and verification of statistics for the purposes of the Census and Statistics Act 1905 and the performance of the functions of the Australian Bureau of Statistics as set out in section 6 of the Australian Bureau of Statistics Act 1975; (f) the protection of the public revenue of the Commonwealth, a Territory or another country; (g) the protection of the public revenue of a State; (h) a purpose relating to a law of customs; (i) a purpose relating to immigration, quarantine or border control between Australia and another country; (ia) a purpose relating to the performance of functions under section 17 of the Australian Security Intelligence Organisation Act 1979; (ib) a purpose relating to the performance of functions under section 6 of the Intelligence Services Act 2001; (ic) the administration of the NAD scheme (within the meaning of the Australian Sports Anti‑Doping Authority Act 2006); (j) the administration or enforcement of laws with respect to commerce: (i) between a State and another State; or (ii) between a State and a Territory; or (iii) between a Territory and another Territory; or (iv) between Australia and another country; (k) the administration or enforcement of laws with respect to commerce within a State. Additional requirements concerning classes of information (10) This subsection is complied with in relation to a disclosure of a class of information pursuant to an authorisation under subsection (3A), (3B), (3C) or (3D) as referred to in subsection (7) if: (a) the disclosure is made to a Commonwealth agency, State agency, a foreign country, an instrumentality or agency of a foreign country or an international organisation, that is specified in the regulations; and (b) the class of information specified by the CEO in the authorisation is specified in the regulations as a class of information that may be disclosed to the agency, country, instrumentality or organisation concerned.