Commonwealth Consolidated Acts Commonwealth Consolidated Acts(1) A person commits an offence if:
(a) the person engages in conduct; and
(b) the conduct results in the circumvention of a technological protection measure; and
(c) the technological protection measure is an access control technological protection measure; and
(d) the person engages in the conduct with the intention of obtaining a commercial advantage or profit.
Defence--permission
(2) Subsection (1) does not apply to the person if the person has the permission of the copyright owner or exclusive licensee to circumvent the access control technological protection measure.
Note: A defendant bears an evidential burden in relation to the matter in subsection (2) (see subsection 13.3(3) of the Criminal Code ).
Defence--interoperability
(3) Subsection (1) does not apply to the person if:
(a) the person circumvents the access control technological protection measure to enable the person to do an act; and
(b) the act:
(i) relates to a copy of a computer program (the original program ) that is not an infringing copy and that was lawfully obtained; and
(ii) will not infringe the copyright in the original program; and
(iia) relates to elements of the original program that will not be readily available to the person when the circumvention occurs; and
(iii) will be done for the sole purpose of achieving interoperability of an independently created computer program with the original program or any other program.
Note: A defendant bears an evidential burden in relation to the matter in subsection (3) (see subsection 13.3(3) of the Criminal Code ).
Defence--encryption research
(4) Subsection (1) does not apply to the person if:
(a) the person circumvents the access control technological protection measure to enable:
(i) the person; or
(ii) if the person is a body corporate--an employee of the person;
to do an act; and
(b) the act:
(i) relates to a copy of a work or other subject - matter that is not an infringing copy and that was lawfully obtained; and
(ii) will not infringe the copyright in the work or other subject - matter; and
(iii) will be done for the sole purpose of identifying and analysing flaws and vulnerabilities of encryption technology; and
(c) the person or employee is:
(i) engaged in a course of study at an educational institution in the field of encryption technology; or
(ii) employed, trained or experienced in the field of encryption technology; and
(d) the person or employee:
(i) has obtained permission from the owner or exclusive licensee of the copyright to do the act; or
(ii) has made, or will make, a good faith effort to obtain such permission.
In this subsection, encryption technology means the scrambling and descrambling of information using mathematical formulas or algorithms.
Note: A defendant bears an evidential burden in relation to the matter in subsection (4) (see subsection 13.3(3) of the Criminal Code ).
Defence--computer security testing
(5) Subsection (1) does not apply to the person if:
(a) the person circumvents the access control technological protection measure to enable the person to do an act; and
(b) the act:
(i) relates to a copy of a computer program that is not an infringing copy; and
(ii) will not infringe the copyright in the computer program; and
(iii) will be done for the sole purpose of testing, investigating or correcting the security of a computer, computer system or computer network; and
(iv) will be done with the permission of the owner of the computer, computer system or computer network.
Note: A defendant bears an evidential burden in relation to the matter in subsection (5) (see subsection 13.3(3) of the Criminal Code ).
Defence--online privacy
(6) Subsection (1) does not apply to the person if:
(a) the person circumvents the access control technological protection measure to enable the person to do an act; and
(b) the act:
(i) relates to a copy of a work or other subject - matter that is not an infringing copy; and
(ii) will not infringe the copyright in the work or other subject - matter; and
(iii) will be done for the sole purpose of identifying and disabling an undisclosed capability to collect or disseminate personally identifying information about the online activities of a natural person; and
(iv) will not affect the ability of the person or any other person to gain access to the work or other subject - matter or any other work or subject - matter.
Note: A defendant bears an evidential burden in relation to the matter in subsection (6) (see subsection 13.3(3) of the Criminal Code ).
Defence--law enforcement and national security
(7) Subsection (1) does not apply in relation to anything lawfully done for the purposes of:
(a) law enforcement; or
(b) national security; or
(c) performing a statutory function, power or duty;
by or on behalf of the Commonwealth, a State or a Territory, or an authority of one of those bodies.
Note: A defendant bears an evidential burden in relation to the matter in subsection (7) (see subsection 13.3(3) of the Criminal Code ).
Defence--libraries etc.
(8) Subsection (1) does not apply in respect of anything lawfully done by the following bodies in performing their functions:
(a) a library (other than a library that is conducted for the profit, direct or indirect, of an individual or individuals);
(b) a body mentioned in:
(i) paragraph (a) of the definition of archives in subsection 10(1); or
(ii) subsection 10(4);
(c) an educational institution;
(d) a public non - commercial broadcaster (including a body that provides a national broadcasting service, within the meaning of the Broadcasting Services Act 1992, and a body that holds a community broadcasting licence within the meaning of that Act).
Note 1: A library that is owned by a person conducting a business for profit might not itself be conducted for profit (see section 18).
Note 2: A defendant bears an evidential burden in relation to the matter in subsection (8) (see subsection 13.3(3) of the Criminal Code ).
(8A) This section does not apply in respect of anything lawfully done by a person in connection with a work or other subject - matter if:
(a) the person has custody of the work or other subject - matter under an arrangement referred to in section 64 of the Archives Act 1983 ; and
(b) under subsection (8), it would be lawful for the National Archives of Australia to do that thing.
Note: A defendant bears an evidential burden in relation to the matter in subsection (8A) (see subsection 13.3(3) of the Criminal Code ).
Defence--prescribed acts
(9) Subsection (1) does not apply to the person if:
(a) the person circumvents the access control technological protection measure to enable the person to do an act; and
(b) the act will not infringe the copyright in a work or other subject - matter; and
(c) the doing of the act by the person is prescribed by the regulations.
Note 1: A defendant bears an evidential burden in relation to the matter in subsection (9) (see subsection 13.3(3) of the Criminal Code ).
Note 2: For the making of regulations prescribing the doing of an act by a person, see section 249.