15IAP service providers’ powers to collect, store, use and disclose IAP information

15 IAP service providers’ powers to collect, store, use and disclose IAP information

(1) An IAP service provider may collect, store and use IAP information (including personal information) for compliance purposes.

Note: ‘For compliance purposes’ is defined in Part 3 of the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003].

(2) An IAP service provider may disclose IAP information (including personal information) to the Authority, or to TCA, for compliance purposes. (3) An IAP service provider may disclose IAP information (including personal information, but not including a non‑compliance report or a report under section 21) to a police officer, or to an authorised officer of the Authority, for law‑enforcement purposes if so authorised by a warrant issued by a court.

Note: An IAP service provider has a separate obligation to make non‑compliance reports to the Authority—see section 20.

Drafting note: Subclause (3) has been read as possibly giving an IAP service provider the choice of not complying with a valid warrant. This is not the intention. If a jurisdiction has any concern that subclause (3) might have that effect, perhaps the subclause could be replaced with one that simply states that nothing in the Bill is intended to affect the operation of any law relating to warrants.

(4) If an IAP service provider discloses IAP information to a police officer or an Authority officer under subsection (3), the police officer or Authority officer must not use the information, or disclose it to any other person, unless: (a) the police officer or Authority officer believes the use or disclosure is reasonably necessary for law‑enforcement purposes; or (b) the use or disclosure is otherwise authorised by or under this Act. (5) With the consent of a participating operator, an IAP service provider may use or disclose IAP information about the operator to a person other than the operator for any purpose if the information: (a) does not identify any individual; and (b) contains nothing by which the identity of any individual can reasonably be ascertained. (6) An IAP service provider may disclose IAP information (except a non‑compliance report) about a participating operator to the operator. (7) In addition, an IAP service provider may use or disclose IAP information (including personal information): (a) with the consent of any person about whom the IAP information includes personal information; or (b) as otherwise authorised by this Act or any other law. (8) An IAP service provider must give an IAP auditor access to any record kept by the IAP service provider for the purposes of this Act.