an individual makes use of any information in the possession or under the control of the Authority which the individual acquired in the performance of the individual’s duties or the exercise of the individual’s functions;
(b)
the use is not authorised by the Authority;
(c)
the individual is or has been a director or an officer or employee of the Authority;
(d)
the individual does so —
(i)
knowing that the use is not authorised by the Authority; or
(ii)
reckless as to whether the use is or is not authorised by the Authority; and
(e)
the individual, as a result of that use —
(i)
obtains a gain for the individual or another person;
(ii)
causes harm to another individual; or
(iii)
causes a loss to another person,
the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 2 years or to both.
[40/2020]
(2) If —
(a)
a person makes use of information (other than personal data about an individual) in the possession or under the control of the Authority which the person acquired in the performance of the person’s duties or the exercise of the person’s functions;
(b)
the use is not authorised by the Authority;
(c)
the person is or has been —
(i)
a contractor supplying goods or services to the Authority;
(ii)
a consultant or an agent of the Authority; or
(iii)
an individual who is an employee of a person mentioned in sub‑paragraph (i) or (ii);
(d)
the person does so —
(i)
knowing that the use is not authorised by the Authority; or
(ii)
reckless as to whether the use is or is not authorised by the Authority; and
(e)
the person, as a result of that use —
(i)
obtains a gain for the person or another person;
(ii)
causes harm to an individual; or
(iii)
causes a loss to another person,
the person shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 2 years or to both.
[40/2020]
(3) In proceedings for an offence under subsection (1) or (2), it is a defence to the charge for the defendant to prove, on a balance of probabilities, any of the following:
(a)
that the information in the possession or under the control of the Authority was, at the time of its use by the defendant, generally available information;
(b)
the defendant used the information in the possession or under the control of the Authority —
(i)
as permitted or required by or under an Act or other law;
(ii)
as authorised or required by an order of court; or
(iii)
in any other prescribed circumstances or for any other prescribed purpose.
[40/2020]
(4) To avoid doubt, subsection (3) does not affect any obligation or limitation imposed on, or prohibition of, the use of personal data in the possession or under the control of the Authority by or under any other written law or other law.