(1) A person commits an offence if:
(a) the person:
(i) obtains information; or
(ii) makes a record of information; or
(iii) discloses information to another person; or
(iv) uses information; and
(b) the person is not authorised or required by or under this Act:
(i) to obtain the information; or
(ii) to make the record of the information; or
(iii) to disclose the information; or
(iv) to use the information; and
(c) the information is protected information.
Penalty: Imprisonment for 2 years or 120 penalty units, or both.
(2) Subsection (1) does not apply if:
(a) the person did not obtain the information under, for the purposes of, or in connection with, the scheme; or
(b) the person had already obtained the information before the person obtained the information under, for the purposes of, or in connection with, the scheme.
Note: A defendant bears an evidential burden in relation to the matter in this subsection (see subsection 13.3(3) of the Criminal Code ).