Document ID: chunk:federal_register_of_legislation:C2024A00104:section:535
Version: federal_register_of_legislation:C2024A00104
Segment Type: section
Provision Reference: s 535
Character Range: 741057–743606

535  Unauthorised use or disclosure of protected information
 (1) A person commits an offence if:
 (a) the person is, or has been, an entrusted person; and
 (b) the person has obtained or generated information in the person's capacity as an entrusted person; and
 (c) the information is protected information; and
 (d) the person uses or discloses the information.
Penalty: Imprisonment for 2 years or 120 penalty units, or both.
 (2) A person commits an offence if:
 (a) the person uses or discloses information; and
 (b) the information is protected information; and
 (c) the information was disclosed to the person; and
 (d) the disclosure of the information to the person was authorised by or under any of the following provisions of this Act:
 (i) subsection 537(8) (reasonable belief about threats to safety, etc.);
 (ii) subsection 537(10) (functions under certain laws relating to worker screening);
 (iii) subsection 538(1) (performance of Minister's functions);
 (iv) subsection 538(4) (individual accessing funded aged care services);
 (v) section 539 (use or disclosure by the System Governor or Appointed Commissioner);
 (vi) subsection 540(1) (coronial inquiries, etc.);
 (vii)  subsection 540(2) (health complaints, etc.);
 (viii) subsection 541(1) (grants); and
 (e) the person is not, and has never been, an entrusted person or, if the person is or has been an entrusted person, the information was not disclosed to the person in that capacity; and
 (f) the purpose for which the person uses or discloses the information is not the purpose for which the information was disclosed to the person.
Penalty: Imprisonment for 2 years or 120 penalty units, or both.
 (3) Subsections (1) and (2) do not apply to a use or disclosure authorised by a provision of Division 2.
Note 1: A defendant bears an evidential burden in relation to the matter in subsection (3): see subsection 13.3(3) of the Criminal Code.
Note 2: Division 2 authorises the use and disclosure of protected information and relevant information in various circumstances. As well as having effect for the purposes of subsection (3), these authorisations have effect for the purposes of the Privacy Act 1988.
 (4) Subsection (2) does not apply to the following:
 (a) conduct of individuals accessing, or seeking to access, funded aged care services;
 (b) conduct of supporters of those individuals;
 (c) conduct of registered providers.
Note: A defendant bears an evidential burden in relation to the matter in subsection (4): see subsection 13.3(3) of the Criminal Code.