Section 103 of the Principal Act is amended by inserting after subsection (2C) the following subsection:

(2D)  A person to whom personal information is disclosed under subsection (2A) or (2B) must not use or disclose the personal information other than –

(a) for the purpose for which the information was so disclosed to the person; or

(b) as authorised or required to do so by law.

Penalty:  Fine not exceeding 50 penalty units or imprisonment for a term not exceeding 2 years, or both.