(1) Subject to this
Act, a person engaged or formerly engaged in the administration, operation or
enforcement of this Act must not disclose personal information obtained
(whether by that person or otherwise) in the course of performing functions or
exercising powers under this Act except—
(a) as
required or authorised by or under this Act or any other Act or law; or
(b) with
the consent of the person to whom the information relates; or
(c) in
connection with the administration or enforcement of this or any other Act; or
(d) for
the purposes of referring the matter to a law enforcement agency, or a person
or agency exercising official duties under an Act relating to the care or
protection of children and young people; or
(e) to
an agency or instrumentality of this State, the Commonwealth or another State
or a Territory of the Commonwealth for the purposes of the proper performance
of its functions; or
(f) if
the disclosure is reasonably necessary for the protection of the lawful
interests of that person.
Maximum penalty: $10 000.
(2)
Subsection (1) does not prevent disclosure of statistical or other data
that could not reasonably be expected to lead to the identification of any
person to whom it relates.
(3) Information that
has been disclosed under subsection (1) for a particular purpose must not
be used for any other purpose by—
(a) the
person to whom the information was disclosed; or
(b) any
other person who gains access to the information (whether properly or
improperly and whether directly or indirectly) as a result of that disclosure.
Maximum penalty: $10 000.
(4) The regulations
may make further provision in respect of the disclosure of information
obtained in the course of the administration of this Act.