(1) A person commits an offence if:
(a) the person makes a record of, discloses or otherwise uses information; and
(b) the information is protected information; and
(c) the information was acquired by the person in the course of performing duties or exercising powers or functions under this Act.
Penalty: Imprisonment for 2 years.
(2) This section does not apply to:
(a) conduct that is carried out in the performance of a function or duty under this Act or the Aged Care Act 1997 or the exercise of a power under, or in relation to, this Act or the Aged Care Act 1997 ; or
(b) the disclosure of protected information only to the person to whom it relates; or
(c) the disclosure of protected information to the Minister or the Secretary; or
(d) conduct carried out by an approved provider; or
(e) conduct that is authorised by the person to whom the information relates; or
(f) conduct that is otherwise authorised under this or any other Act.
Note: A defendant bears an evidential burden in relation to the matters in subsection (2) (see subsection 13.3(3) of the Criminal Code ).