130Unauthorised use or disclosure of protected information—entrusted person

130  Unauthorised use or disclosure of protected information—entrusted person

 (1) A person is liable to a civil penalty if:

 (a) the person is, or has been, an entrusted person; and

 (b) the person has obtained relevant information in the person’s capacity as an entrusted person; and

 (c) the information is protected information; and

 (d) the person uses or discloses the information.

Civil penalty: 200 penalty units.

Exception—required or authorised by law

 (2) Subsection (1) does not apply if the use or disclosure of the information is required or authorised by:

 (a) this Act or the rules; or

 (b) any other law of the Commonwealth; or

 (c) a law of a State or Territory prescribed by the rules.

Note: A defendant bears an evidential burden in relation to the matters in this subsection (see section 96 of the Regulatory Powers Act).