(1)  The Secretary, an authorised officer, a public authority and any other person engaged in the administration or enforcement of this Act may collect and use information (including personal information and health information) for the purpose of performing their biosecurity risk functions.

(2)  The Secretary, an authorised officer, a public authority and any other person engaged in the administration or enforcement of this Act may, for the purpose of performing a biosecurity risk function, disclose information (including personal information and health information) about a person, without the consent of the person –

(a) to a public authority; or

(b) to any other person if the disclosure is reasonably necessary for the purpose of performing a biosecurity risk function.

(3)  A public authority may disclose to the Secretary, an authorised officer, or any other person engaged in the administration or enforcement of this Act any information (including personal information and health information) about a person that the public authority holds, without the consent of the person, if the Secretary, authorised officer or other person requests the information and certifies in writing that the information –

(a) is required for the purpose of performing a biosecurity risk function; and

(b) the provision of the information is reasonably necessary for the purpose of performing that biosecurity risk function.

(4)  The Secretary, authorised officers, and any other persons engaged in the administration of this Act are not required to comply with section 17 of the Personal Information Protection Act 2004 if such compliance would detrimentally affect or prevent the performance of their biosecurity risk functions.

(5)  Nothing in this section prevents or limits the release or publication of any public information held, collected or used under this Act.