Document ID: chunk:federal_register_of_legislation:C2017A00012:clause:1_26wf:p2
Version: federal_register_of_legislation:C2017A00012
Segment Type: clause
Provision Reference: sch 1 cl 26WF (pt 2/2)
Character Range: 10682–12960

the action, there is no unauthorised access to, or unauthorised disclosure of, the information;
the loss is not, and is taken never to have been:
 (e) an eligible data breach of the APP entity, credit reporting body, credit provider or file number recipient, as the case may be; or
 (f) an eligible data breach of any other entity.
 (4) If:
 (a) a loss of information is covered by paragraph 26WE(2)(b); and
 (b) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, takes action in relation to the loss; and
 (c) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, does so:
 (i) after there is unauthorised access to, or unauthorised disclosure of, the information; and
 (ii) before the access or disclosure results in serious harm to any of the individuals to whom the information relates; and
 (d) as a result of the action, a reasonable person would conclude that the access or disclosure would not be likely to result in serious harm to any of those individuals;
the loss is not, and is taken never to have been:
 (e) an eligible data breach of the APP entity, credit reporting body, credit provider or file number recipient, as the case may be; or
 (f) an eligible data breach of any other entity.
 (5) If:
 (a) a loss of information is covered by paragraph 26WE(2)(b); and
 (b) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, takes action in relation to the loss; and
 (c) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, does so:
 (i) after there is unauthorised access to, or unauthorised disclosure of, the information; and
 (ii) before the access or disclosure results in serious harm to a particular individual to whom the information relates; and
 (d) as a result of the action, a reasonable person would conclude that the access or disclosure would not be likely to result in serious harm to the individual;
this Part does not require:
 (e) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be; or
 (f) any other entity;
to take steps to notify the individual of the contents of a statement that relates to the loss.