26XCDisclosure of information—offence

#### 26XC Disclosure of information—offence (1) A person (the first person) commits an offence if: (a) personal information that relates to an individual is disclosed to the first person because of the operation of this Division; and (b) the first person subsequently discloses the personal information. Penalty: 60 penalty units or imprisonment for 1 year, or both. (2) Subsection (1) does not apply to the following disclosures: (a) if the first person is an APP entity—a disclosure permitted under an Australian Privacy Principle, a registered APP code that binds the person or a rule issued under section 17 (rules relating to tax file number information); (b) a disclosure for the purposes of carrying out a State’s constitutional functions, powers or duties; (c) a disclosure for the purposes of obtaining or providing legal advice in relation to the operation of this Division; (d) a disclosure permitted under section 26XB; (e) a disclosure made with the consent of the individual to whom the personal information relates; (f) a disclosure to the individual to whom the personal information relates; (g) a disclosure to a court; (h) a disclosure prescribed by the regulations. > Note: A defendant bears an evidential burden in relation to a matter in this subsection (see subsection 13.3(3) of the Criminal Code). (3) If a disclosure of personal information is covered by subsection (2), the disclosure is authorised by this section. (4) For the purposes of paragraph (2)(g), court includes any tribunal, authority or person having power to require the production of documents or the answering of questions.