Document ID: chunk:federal_register_of_legislation:C2017A00012:clause:1_26wq:p1
Version: federal_register_of_legislation:C2017A00012
Segment Type: clause
Provision Reference: sch 1 cl 26WQ (pt 1/2)
Character Range: 22170–24927

26WQ  Exception—declaration by Commissioner
 (1) If the Commissioner:
 (a) is aware that there are reasonable grounds to believe that there has been an eligible data breach of an entity; or
 (b) is informed by an entity that the entity is aware that there are reasonable grounds to believe that there has been an eligible data breach of the entity;
the Commissioner may, by written notice given to the entity:
 (c) declare that sections 26WK and 26WL do not apply in relation to:
 (i) the eligible data breach of the entity; and
 (ii) if the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities—such an eligible data breach of those other entities; or
 (d) declare that subsection 26WL(3) has effect in relation to:
 (i) the eligible data breach of the entity; and
 (ii) if the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities—such an eligible data breach of those other entities;
  as if that subsection required compliance with subsection 26WL(2) before the end of a period specified in the declaration.
 (2) The Commissioner's power in paragraph (1)(d) may only be used to extend the time for compliance with subsection 26WL(2) to the end of a period that the Commissioner is satisfied is reasonable in the circumstances.
 (3) The Commissioner must not make a declaration under subsection (1) unless the Commissioner is satisfied that it is reasonable in the circumstances to do so, having regard to the following:
 (a) the public interest;
 (b) any relevant advice given to the Commissioner by:
 (i) an enforcement body; or
 (ii) the Australian Signals Directorate of the Defence Department;
 (c) such other matters (if any) as the Commissioner considers relevant.
 (4) Paragraph (3)(b) does not limit the advice to which the Commissioner may have regard.
 (5) The Commissioner may give a notice of a declaration to an entity under subsection (1):
 (a) on the Commissioner's own initiative; or
 (b) on application made to the Commissioner by the entity.

Applications
 (6) An application by an entity under paragraph (5)(b) may be expressed to be:
 (a) an application for a paragraph (1)(c) declaration; or
 (b) an application for a paragraph (1)(d) declaration; or
 (c) an application for:
 (i) a paragraph (1)(c) declaration; or
 (ii) in the event that the Commissioner is not disposed to make such a declaration—a paragraph (1)(d) declaration.
 (7) If an entity applies to the Commissioner under paragraph (5)(b):
 (a) the Commissioner may refuse the application; and
 (b) if the Commissioner does so—the Commissioner must give written notice of the refusal to the entity.