Document ID: chunk:federal_register_of_legislation:F2016L00360:reg:14:p8
Version: federal_register_of_legislation:F2016L00360
Segment Type: reg
Provision Reference: reg 14 (pt 8/16)
Character Range: 20325–23381

increasing issue which may pose ongoing compliance or enforcement issues;
           k)     action taken by the individual or entity to remedy and address the consequences of the conduct, including whether the individual or entity attempted to conceal a contravention or data breach, and whether the individual or entity has co-operated with the Information Commissioner during containment and any investigation of the contravention;
           l)       whether the conduct has affected the security or integrity of the My Health Record system or impacted on healthcare provider or healthcare recipient confidence in the My Health Record system;
           m)   the time since the conduct occurred;
           n)     the cost and time required to achieve an appropriate remedy through enforcement action;
           o)     whether there is adequate evidence available and admissible in a court to prove a contravention on the balance of probabilities;
           p)     any other factors which the Information Commissioner considers relevant in the circumstances, including factors which are relevant to the specific regulatory power being used.

7.2  It is open to the Information Commissioner to use a combination of enforcement powers to address a particular contravention.

  Administrative action of the System Operator
7.3  Section 73A of the My Health Records Act authorises the Information Commissioner to disclose to the System Operator any information or documents that relate to an investigation that the Information Commissioner conducts because of the operation of section 73 of that Act, if the Information Commissioner is satisfied that to do so will enable the System Operator to monitor or improve the operation or security of the My Health Record system.
7.4  A disclosure under section 73A of the My Health Records Act may also assist the System Operator in exercising the power to cancel, suspend or vary a person's registration with the My Health Record system in certain circumstances in accordance with the My Health Records Act.
  General litigation principle
7.5  In any litigation, the Information Commissioner will act in accordance with the Commonwealth's model litigant obligations within the meaning under Appendix B of the Legal Services Directions 2005.
  Publication of use of enforcement powers
7.6  The Information Commissioner may communicate publicly information about his or her use of enforcement powers under the Privacy Act or My Health Records Act.
7.7  In relation to enforceable undertakings accepted under s 33E of the Privacy Act or s 80 of the My Health Records Act, the Information Commissioner will generally publish accepted enforceable undertakings.
7.8  The Information Commissioner will publish determinations made under section 52 of the Privacy Act. The Commissioner will generally publish the name of the respondent. However, the Commissioner will generally not publish the names of complainants, respondent individuals or any third party individuals.
Part 3 Use of enforcement powers under the