Document ID: chunk:federal_register_of_legislation:C2025C00160:section:53
Version: federal_register_of_legislation:C2025C00160
Segment Type: section
Provision Reference: s 53
Character Range: 94523–95954

53  Data profiling to track online behaviour is prohibited
 (1) An accredited entity must not use or disclose information if:
 (a) the information is personal information about an individual that is in the entity's possession or control; and
 (b) the information is any of the following:
 (i) information about the services provided by the entity that the individual has accessed, or attempted to access;
 (ii) information relating to how or when access was obtained or attempted to be obtained by the individual;
 (iii) information relating to the method of access or attempted access by the individual;
 (iv) the date and time the individual's identity was verified.
Civil penalty: 1,500 penalty units.
 (2) Subsection (1) applies even if the individual has consented to the use or disclosure.
 (3) However, subsection (1) does not apply if the use or disclosure:
 (a) is for purposes relating to improving the performance or useability of the entity's information technology system through which the entity's accredited services are provided and not for broader business purposes; or
 (b) is for the purposes of the entity complying with this Act; or
 (c) is required or authorised by or under a law of the Commonwealth, a State or a Territory.
Note: A person who wishes to rely on this subsection bears an evidential burden in relation to the matter mentioned in this subsection (see section 96 of the Regulatory Powers Act).