(1) An employer commits an offence if the employer fails to take reasonable steps to protect surveillance records it holds from misuse, loss, unauthorised access, modification or disclosure.
Maximum penalty: 20 penalty units.
(2) An employer commits an offence if—
(a) a surveillance record is no longer needed for any purpose for which the record may be used or disclosed under this Act; and
(b) the employer fails to take reasonable steps to destroy or permanently de-indentify the surveillance record.
Maximum penalty: 20 penalty units.