(1) A person must not,
directly or indirectly, use or disclose any information obtained by the person
because of —
(a) the
person’s office, position, employment or engagement under or for the
purposes of this Act; or
(b) any
disclosure made to the person under or for the purposes of this Act.
Penalty for this subsection: a fine of
$10 000.
(2)
Subsection (1) does not apply in relation to the use or disclosure of
information that is —
(a)
already in the public domain; or
(b)
statistical or other information that could not reasonably be expected to lead
to the identification of any person to whom it relates.
(3) A person does not
commit an offence under subsection (1) if the use or disclosure of the
information is authorised under section 505(1).