35IAP auditors’ duties in regard to use and disclosure of information

35 IAP auditors’ duties in regard to use and disclosure of information

(1) An IAP auditor must not use or disclose IAP information unless it first takes reasonable steps to ensure that, having regard to the purpose for which the information is to be used or disclosed, that the information is accurate, complete, up‑to‑date and not misleading. (2) An IAP auditor must not use or disclose information for a purpose other than the purpose for which the information was collected. (3) An IAP auditor must not use or disclose information relating to a particular participating operator other than to: (a) the operator; or (b) TCA; or (c) the Authority; unless the use or disclosure is authorised under this Act or another law. (4) An IAP auditor must not disclose information relating to non‑compliance or tampering except to: (a) the Authority; or (b) TCA. (5) If an IAP auditor uses or discloses IAP information (other than use or disclosure for law‑enforcement purposes), the IAP auditor must make a record of the use or disclosure containing the following information: (a) the name of the person who used or disclosed the IAP information; (b) the date of the disclosure or use; (c) in the case of a disclosure of IAP information, the person or body to whom or to which the information was disclosed; (d) in the case of a use of IAP information, a brief description of how the information was used; (e) what provision of this Act or another law the disclosure or use was authorised by; (f) if the authority for the disclosure or use also required a document (for example, a warrant, a certificate or a consent), a copy of the document. (6) The IAP auditor must make the record within 5 business days after the relevant use or disclosure. (7) The IAP auditor must make the record in a form that allows the record to be readily inspected. (8) The IAP auditor must retain the record for 2 years (or another period prescribed by the regulations for the purposes of this subsection). (9) An IAP auditor commits an offence if it does not comply with a requirement of any of subsections (1) to (8).

Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.

(10) An offence against subsection (9) is an offence of strict liability.