Document ID: chunk:federal_register_of_legislation:F2016L00360:reg:14:p15
Version: federal_register_of_legislation:F2016L00360
Segment Type: reg
Provision Reference: reg 14 (pt 15/16)
Character Range: 39727–42848

record;
           b)     section 74 – a registered healthcare provider organisation providing insufficient information to identify the individual who requests access to a healthcare recipient's digital record on behalf of the registered healthcare provider organisation;
           c)      section 75 – failure of an entity which is, or has at any time been, a registered healthcare provider organisation, registered repository operator, registered portal operator or registered contracted service provider to report a data breach in accordance with the requirements of section 75;
           d)     section 76 – failure to notify the System Operator, within the required timeframe, in writing of becoming ineligible to be registered as a registered healthcare provider organisation, a registered repository operator, a registered portal operator or a registered contracted service provider;
           e)      section 77 – the System Operator, a registered repository operator, a registered portal operator or a registered contracted service provider holding, taking, processing or handling My Health Record system records outside Australia, or causing or permitting another person to hold, take, process or handle My Health Record system records outside Australia;
           f)       section 78 – contravention of the My Health Record Rules by a person who is, or has at any time been, a registered healthcare provider organisation, registered repository operator, registered portal operator or registered contracted service provider.
13.4    Subsection 82(5) of the Regulatory Powers Act specifies the maximum pecuniary penalty that a Court may impose.

  General approach to civil penalties
13.5  In deciding whether to seek an order imposing a civil penalty, the Information Commissioner may consider:
           a)      the particular facts of the matter;
           b)     the factors referred to at section 7.1 of these guidelines;
           c)      the Commonwealth's model litigant obligations referred to at section 7.5 of these guidelines;
           d)     the guiding principle that the Information Commissioner is unlikely to seek a civil penalty order for minor or inadvertent contraventions, where the person responsible for the contravention has co‑operated with the investigation and taken steps to avoid future contraventions.
14 Civil penalties under the Privacy Act
  Legislative basis for seeking a civil penalty order
14.1  Under section 80W(1) of the Privacy Act, the Information Commissioner may apply to the Federal Court or the Federal Circuit Court for an order that a person who is alleged to have contravened a civil penalty provision of that Act pay a pecuniary penalty to the Commonwealth.
14.2  A contravention of the My Health Records Act in connection with health information included in a healthcare recipient's My Health Record or a provision of Part 4 or 5 is an interference with privacy for the purposes of the Privacy Act. Section 13G of the Privacy Act, relating to serious and repeated interferences with privacy, is a civil penalty provision. Therefore, particular conduct