40Notification of eligible data breaches—accredited entities that are not APP entities

40 Notification of eligible data breaches—accredited entities that are not APP entities

(1) This section applies to an accredited entity that is not an APP entity. (2) Despite subsection (1), this section does not apply to an accredited entity if: (a) the entity is a department or authority of a State or Territory; and (b) a law of the State or Territory provides for a scheme for the notification of data breaches that: (i) covers the entity; and (ii) is comparable to the scheme provided for in Part IIIC of the Privacy Act 1988.

Note: See section 41 for requirements in relation to these entities.

(3) Part IIIC of the Privacy Act 1988, and any other provision of that Act that relates to that Part, apply in relation to the accredited entity as if the entity were an APP entity. (4) If: (a) the accredited entity is aware that there are reasonable grounds to believe that there has been an eligible data breach (within the meaning of the Privacy Act 1988) of the entity relating to the entity’s accredited services; and (b) because of the operation of subsection (3) of this section, the entity is required under section 26WK of that Act to give the Information Commissioner a statement that complies with subsection 26WK(3) of that Act; the entity must also give a copy of the statement to the Digital ID Regulator at the same time as the statement is given to the Information Commissioner.