An entity must not collect, use or disclose a student identifier of an individual if:
(a) the entity is not the individual; and
(b) the collection, use or disclosure is not authorised under this Division.
Note: A contravention of this section is taken to be an interference with the privacy of the individual for the purposes of the Privacy Act 1988 (see section 23 of this Act).