53Data profiling to track online behaviour is prohibited

53 Data profiling to track online behaviour is prohibited

(1) An accredited entity must not use or disclose information if: (a) the information is personal information about an individual that is in the entity’s possession or control; and (b) the information is any of the following: (i) information about the services provided by the entity that the individual has accessed, or attempted to access; (ii) information relating to how or when access was obtained or attempted to be obtained by the individual; (iii) information relating to the method of access or attempted access by the individual; (iv) the date and time the individual’s identity was verified.

Civil penalty: 1,500 penalty units.

(2) Subsection (1) applies even if the individual has consented to the use or disclosure. (3) However, subsection (1) does not apply if the use or disclosure: (a) is for purposes relating to improving the performance or useability of the entity’s information technology system through which the entity’s accredited services are provided and not for broader business purposes; or (b) is for the purposes of the entity complying with this Act; or (c) is required or authorised by or under a law of the Commonwealth, a State or a Territory.

Note: A person who wishes to rely on this subsection bears an evidential burden in relation to the matter mentioned in this subsection (see section 96 of the Regulatory Powers Act).