Document ID: chunk:federal_register_of_legislation:F2016C00635:clause:1_18
Version: federal_register_of_legislation:F2016C00635
Segment Type: clause
Provision Reference: sch 1 cl 18
Character Range: 26410–27340

18  IAP service providers' obligations to keep records of monitoring
 (1) An IAP service provider must keep a record of the IAP information that it collects.
 (2) The record must be organised in a way that allows the record to be conveniently and properly audited.
 (3) An IAP service provider must keep:
 (a) a copy of a non‑compliance report; and
 (b) the data that were relied on to generate the report;
for at least 4 years after the report is made by the provider.
Penalty: $10 000.
 (4) An IAP service provider must take reasonable steps to protect IAP information collected by it against unauthorised access, unauthorised use, misuse, loss, modification or unauthorised disclosure.
 (5) An IAP service provider must take reasonable steps to destroy IAP information (including personal information), other than information required by subsection (3) to be kept, 1 year after the information is collected.
Penalty: $10 000.