59UExemption if public sector agency has taken certain action

59U Exemption if public sector agency has taken certain action

59U Exemption if public sector agency has taken certain action

The head of a public sector agency is exempt from Division 3, Subdivision 3 if—

(a) for an eligible data breach involving unauthorised access to, or disclosure of, personal information held by the agency—

(i) the agency the subject of the breach takes action to mitigate the harm done by the breach, and

(ii) the action is taken before the access to or disclosure of information results in serious harm to an individual, and

(iii) because of the action taken, a reasonable person would conclude that the access or disclosure would not be likely to result in serious harm to an individual, or

(b) for an eligible data breach involving the loss of personal information held by the agency—

(i) the agency the subject of the breach takes action to mitigate the loss, and

(ii) the action is taken before there is unauthorised access to, or unauthorised disclosure of, the information, and

(iii) because of the action taken, there is no unauthorised access to, or unauthorised disclosure of, the information.

s 59U: Ins 2022 No 74, Sch 1[11].