Fault - based offence
(1) A person commits an offence if:
(a) the person obtains protected information in the course of, or for the purposes of, performing functions or duties or exercising powers under this Act; and
(b) the person uses or discloses the information; and
(c) the use or disclosure is not authorised by a provision in this Part or by rules made for the purposes of section 30.
Penalty: Imprisonment for 2 years or 120 penalty units, or both.
Exception for use or disclosure in good faith
(2) Subsection (1) does not apply to a person to the extent that the person uses or discloses protected information in good faith and in purported compliance with a provision in this Part or with rules made for the purposes of section 30.
Note: A defendant bears an evidential burden in relation to the matter in this subsection (see subsection 13.3(3) of the Criminal Code ).