323‑1 Prohibition on disclosure of infor323‑1 Prohibition on disclosure of information

323‑1 Prohibition on disclosure of information (1) A person commits an offence if: (a) the person has, or has at any time had, a duty, function or power under this Act; and (aa) the duty, function or power is not an *APRA private health insurance duty, function or power; and (b) the person discloses information to another person; and (c) the information is *protected information; and (d) the disclosure is not an *authorised disclosure. Penalty: Imprisonment for 2 years or 120 penalty units, or both. (1A) An APRA private health insurance duty, function or power is a duty, function or power of *APRA, or that a person has in the person’s capacity as an officer (within the meaning of section 56 of the Australian Prudential Regulation Authority Act 1998), under any of the following: (a) this Act; (b) the Private Health Insurance (Prudential Supervision) Act 2015; (c) the Financial Institutions Supervisory Levies Collection Act 1998, as that Act applies in relation to levies imposed on private health insurers; (d) the Financial Sector (Collection of Data) Act 2001, as that Act applies in relation to private health insurers. Note: The disclosure of information regime for information obtained under APRA private health insurance duties, functions and powers is Part 6 of the Australian Prudential Regulation Authority Act 1998 (rather than this Division). (2) Information is protected information if the information: (a) either: (i) is obtained by a person in the course of performing or exercising a duty, function or power under this Act, other than an *APRA private health insurance duty, function or power; or (ii) was information to which subparagraph (i) applied and is obtained by a person by way of an *authorised disclosure under section 323‑10, 323‑15 or 323‑20; and (b) relates to a person other than the person who obtained it. (3) A disclosure of information is an authorised disclosure if the disclosure is one that the person may make under section 323‑5, 323‑10, 323‑15, 323‑20, 323‑25 or 323‑30. Note: A disclosure in accordance with subsection 132D(1) of the National Health Act 1953 is also taken to be an authorised disclosure for the purposes of this section: see subsection 132D(3) of the National Health Act 1953.