Document ID: chunk:federal_register_of_legislation:C2024C00188:section:22a:p2
Version: federal_register_of_legislation:C2024C00188
Segment Type: section
Provision Reference: s 22A (pt 2/3)
Character Range: 32223–35083

notifying individuals who may be affected.
Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing.

Handling contraventions
 (5) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:
 (a) so far as is reasonably practicable, contain the contravention and undertake a preliminary assessment of the causes;
 (b) evaluate any risks that may be related to or arise out of the contravention;
 (c) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected;
 (d) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected;
 (e) take steps to prevent or mitigate the effects of further contraventions.
Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the contravention, regardless of when it occurred or whether it is ongoing.

Secretary's duty
 (6) The Secretary must comply with a request under subparagraph (4)(c)(ii) or paragraph (5)(d).

No need to report or consult if already done
 (7) A person is not required to comply with subsection (1) or (2) in relation to a contravention that has occurred if the person has already given notice under that subsection that the contravention may have occurred.
 (8) A person is not required to comply with paragraph (5)(c) or (d) in relation to a contravention if the person has already consulted, or asked the Secretary to consult, the Information Commissioner under paragraph (4)(c) in relation to the contravention.
 (9) A contracted service provider or former contracted service provider is not required to comply with subsection (2), subparagraph (4)(c)(ii) or paragraph (5)(d) in relation to a contravention that has, or may have, occurred if another person has already:
 (a) given notice in relation to the contravention under subsection (1) or (2); or
 (b) consulted, or asked the Secretary to consult, the Information Commissioner in relation to the contravention under paragraph (4)(c) or (5)(c) or (d).

Contracted service providers
 (10) In this Act:

contracted service provider means a person who:
 (a) is engaged under an agreement referred to in section 26; and
 (b) obtains protected information in the course of performing services under the agreement.