16IAP service providers’ duties in regard to recording use and disclosure of information

16 IAP service providers’ duties in regard to recording use and disclosure of information

(1) If an IAP service provider uses or discloses IAP information, the IAP service provider must make a record of the use or disclosure containing the following information: (a) the name of the person who used or disclosed the IAP information; (b) the date of the disclosure or use; (c) in the case of a disclosure of IAP information, the person or body to whom or to which that information was disclosed; (d) in the case of the use of IAP information by the IAP service provider, a brief description of how the information was used; (e) what provision of this Act or another law the disclosure or use was authorised by; (f) if the authority for the disclosure or use also required a document (for example, a warrant, a certificate or a consent), a copy of the document. (2) The IAP service provider must make the record within 5 business days after the relevant use or disclosure. (3) The IAP service provider must make the record in a form that allows the record to be readily inspected. (4) The IAP service provider must retain the record for 2 years. (5) An IAP service provider commits an offence if it does not comply with a requirement of any of subsections (1) to (4).

Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.

(6) An offence against subsection (5) is an offence of strict liability.