22AData breaches

22A Data breaches

Notification of contraventions and possible contraventions (1) If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner.

Note: This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.

(2) If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify: (a) the Secretary; and (b) the Information Commissioner.

Note: This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.

Civil penalty: 100 penalty units.

(3) A notice given under subsection (1) or (2) must set out the following: (a) a description of the contravention that has occurred or may have occurred; (b) the kind or kinds of information concerned; (c) if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider. Handling possible contraventions (4) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following: (a) so far as is reasonably practicable, contain the possible contravention; (b) evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention; (c) if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register: (i) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or (ii) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected.