A person commits an offence if:
(a) the person obtains protected information; and
(b) the person does so by way of an authorised disclosure under section 36; and
(c) the person discloses the protected information; and
(d) the disclosure by the person is not an authorised disclosure.
Penalty: Imprisonment for 2 years or 120 penalty units, or both.