Section 80Q — Privacy Act 1988: Disclosure of information—offence

(1) A person (the first person) commits an offence if: (a) personal information that relates to an individual is disclosed to the first person because of the operation of this Part; and (b) the first person subsequently discloses the personal information; and (c) the first person is not a responsible person for the individual. Penalty: 60 penalty units or imprisonment for 1 year, or both. (2) Subsection (1) does not apply to the following disclosures: (a) if the first person is an APP entity—a disclosure permitted under an Australian Privacy Principle or a registered APP code that binds the person; (b) a disclosure for the purposes of carrying out a State’s constitutional functions, powers or duties; (ba) a disclosure for the purposes of obtaining or providing legal advice in relation to the operation of this Part; (c) a disclosure permitted under section 80P; (d) a disclosure made with the consent of the individual to whom the personal information relates; (e) a disclosure to the individual to whom the personal information relates; (f) a disclosure to a court; (g) a disclosure prescribed by the regulations. Note: A defendant bears an evidential burden in relation to a matter in subsection (2) (see subsection 13.3(3) of the Criminal Code). (3) If a disclosure of personal information is covered by subsection (2), the disclosure is authorised by this section. (4) For the purposes of paragraph (2)(f), court includes any tribunal, authority or person having power to require the production of documents or the answering of questions.