12Exercise of functions

12 Exercise of functions

12 Exercise of functions

The Secretary must not exercise an identity protection function unless the exercise of the function is—

(a) at the request of the following—

(i) a person who the Secretary is satisfied is, or may be, affected by a personal data compromise,

(ii) a law enforcement agency,

(iii) a fraud check user, or

(b) in response to the following—

(i) a personal data compromise for which the source of the personal data cannot reasonably be determined,

(ii) compromised personal data made available on the internet, whether on the clear or dark web, or

(c) to establish, keep and disclose information on and in relation to the compromised ID register, or

(d) to determine and disclose information about the life status of an individual, or

(e) to advise on and recommend actions for the detection, prevention and mitigation of the likelihood of personal data compromises, or

(f) in other circumstances prescribed by the regulations.