54Certain personal information must not be used or disclosed for prohibited enforcement purposes

54 Certain personal information must not be used or disclosed for prohibited enforcement purposes

(1) An accredited entity must not use or disclose personal information of an individual that is in the entity’s possession or control for the purposes of enforcement related activities conducted by, or on behalf of, an enforcement body unless: (a) the personal information is not biometric information of the individual; and (b) any of the following apply: (i) at the time the information is used or disclosed, the accredited entity is satisfied that the enforcement body has started proceedings against a person for an offence against a law of the Commonwealth, a State or a Territory; (ii) at the time the information is used or disclosed, the accredited entity is satisfied that the enforcement body has started proceedings against a person in relation to a breach of a law imposing a penalty or sanction; (iii) the disclosure of the information is required or authorised by or under a warrant issued under a law of the Commonwealth, a State or a Territory; (iv) the information is used or disclosed for the purposes of reporting a suspected or actual digital ID fraud incident or suspected or actual cyber security incident; (v) the information is used or disclosed by the accredited entity for the purposes of complying with this Act; (vi) the information is disclosed with the express consent of the individual to whom the personal information relates, or purports to relate, and the disclosure is for the purpose of verifying the identity of the individual, or investigating or prosecuting an offence against a law of the Commonwealth, a State or a Territory.

Civil penalty: 1,500 penalty units.

(2) Subsection (1) does not apply in relation to enforcement related activities conducted by, or on behalf of, an enforcement body under, or for the purpose of, this Act or the Privacy Act 1988. (3) Despite section 96 of the Regulatory Powers Act, in proceedings for a civil penalty order against a person for a contravention of subsection (1), the person does not bear an evidential burden in relation to the matter in subparagraphs (1)(b)(i) to (vi) or subsection (2). (4) This section applies despite: (a) section 86E of the Crimes Act 1914 (about disclosure of personal information to certain entities for integrity purposes); and (b) any other law of the Commonwealth, a State or a Territory, whether enacted or made before or after the commencement of this section.