212LDisclosure framework

212L  Disclosure framework  (1) The Registrar may, by legislative instrument, make a disclosure framework relating to disclosing protected information.  (2) Without limiting subsection (1), the disclosure framework may provide for any of the following:  (a) circumstances in which information must not be disclosed without the consent of the person to whom it relates;  (b) circumstances in which de‑identified information may be disclosed;  (c) circumstances in which information may be disclosed to the general public;  (d) circumstances in which confidentiality agreements are required for the disclosure of information;  (e) imposing conditions on disclosure of information.  (3) Without limiting subsection (1), the disclosure framework may provide differently in relation to different functions or powers of the Registrar under this Act.  (a) the person is a party to a confidentiality agreement of a kind mentioned in paragraph (2)(d); and  (b) the person fails to comply with the confidentiality agreement. Penalty: 100 penalty units or imprisonment for 2 years, or both.  (5) The disclosure framework must not provide for disclosure of protected information unless the Registrar is satisfied that the benefits of the disclosure would outweigh the risks of the disclosure (taking into account any mitigation of those risks in accordance with the disclosure framework).  (6) However, subsection (5) does not apply to the extent that the disclosure framework deals with a matter in accordance with a direction under section 212D.  (7) If:  (a) a Commonwealth body (the new Registrar) is appointed as the Registrar with particular functions or powers under this Act; and  (b) immediately before that appointment, another Commonwealth body was the Registrar with those functions or powers; and  (c) the new Registrar does not have a disclosure framework that would apply to those functions or powers; the disclosure framework applying to those functions or powers immediately before that appointment continues to apply until the new Registrar makes a disclosure framework that applies to those functions or powers, or amends its existing disclosure framework to apply to those functions or powers.