77Requirement not to hold or take records outside Australia

77 Requirement not to hold or take records outside Australia

(1) The System Operator, a registered repository operator, a registered portal operator or a registered contracted service provider that holds records for the purposes of the My Health Record system (whether or not the records are also held for other purposes) or has access to information relating to such records, must not: (a) hold the records, or take the records, outside Australia; or (b) process or handle the information relating to the records outside Australia; or (c) cause or permit another person: (i) to hold the records, or take the records, outside Australia; or (ii) to process or handle the information relating to the records outside Australia. (2) Despite subsection (1), the System Operator is authorised, for the purposes of the operation or administration of the My Health Record system: (a) to hold and take such records outside Australia, provided that the records do not include: (i) personal information in relation to a healthcare recipient or a participant in the My Health Record system; or (ii) identifying information of an individual or entity; and (b) to process and handle such information outside Australia, provided that the information is neither of the following: (i) personal information in relation to a healthcare recipient or a participant in the My Health Record system; (ii) identifying information of an individual or entity. Fault‑based offence (2A) A person commits an offence if the person contravenes subsection (1).

Penalty: Imprisonment for 5 years or 300 penalty units, or both.

Note: Where a fault element for a physical element of an offence is not stated, see section 5.6 of the Criminal Code for the appropriate fault element.

Civil penalty (2B) A person is liable to a civil penalty if the person contravenes subsection (1).

Civil penalty: 1,500 penalty units.

(3) This section does not limit the operation of section 99.