40Unauthorised use or disclosure of protected information

40 Unauthorised use or disclosure of protected information

(1) A person commits an offence if: (a) the person is, or has been, an entrusted person; and (b) the person obtains information in the person’s capacity as an entrusted person; and (c) the information is protected information; and (d) the person uses or discloses the information; and (e) the use or disclosure is not authorised by a provision in Subdivision B.

Penalty: Imprisonment for 2 years.

(2) Subsection (1) does not apply in relation to use or disclosure of information if the information has already been lawfully made available to the public.

Note: A defendant bears an evidential burden in relation to a matter in subsection (2) (see subsection 13.3(3) of the Criminal Code).

(3) Subsection (1) does not apply if the conduct is: (a) authorised by a law of the Commonwealth other than the following: (i) this Act; (ii) subsection 11CM(1) of the Banking Act 1959; (iii) subsection 109E(1) of the Insurance Act 1973; (iv) subsection 231E(1) of the Life Insurance Act 1995; (v) subsection 72(1) or section 73 of the Financial Accountability Regime Act 2023; or (b) in compliance with a requirement under a law of the Commonwealth other than this Act.

Note: A defendant bears an evidential burden in relation to a matter in subsection (3) (see subsection 13.3(3) of the Criminal Code).

(4) Section 15.4 of the Criminal Code (Extended geographical jurisdiction—category D) applies to an offence against subsection (1).