24TCA’s duties in regard to use and disclosure of information

24 TCA’s duties in regard to use and disclosure of information

(1) TCA must not use or disclose IAP information unless it first takes reasonable steps to ensure that, having regard to the purpose for which the information is to be used or disclosed, that the information is accurate, complete, up‑to‑date and not misleading. (2) Subject to sections 26 and 27, TCA must not use or disclose information for a purpose other than the purpose for which the information was collected. (3) TCA must not use or disclose information relating to a particular participating operator other than to: (a) the operator; or (b) an IAP auditor; or (c) the Authority; unless the disclosure is authorised under this Act or another law. (4) TCA must not disclose information relating to a breach of an IAP service provider’s obligations except to: (a) the Authority; or (b) an IAP auditor. (5) If TCA uses or discloses IAP information (other than use or disclosure for law enforcement), TCA must make a record of the use or disclosure containing the following information: (a) the name of the person who used or disclosed the IAP information; (b) the date of the disclosure or use; (c) in the case of a disclosure of IAP information, the person or body to whom or to which the information was disclosed; (d) in the case of the use of IAP information by TCA, a brief description of how the information was used; (e) what provision of this Act or another law the disclosure or use was authorised by; (f) if the authority for the disclosure or use also required a document (for example, a warrant, a certificate or a consent), a copy of the document. (6) TCA must make the record within 5 business days after the relevant use or disclosure. (7) TCA must make the record in a form that allows the record to be readily inspected. (8) TCA must retain the record for 2 years (or another period prescribed by the regulations for the purposes of this subsection).