Clause 27

by deleting subsection (1) and substituting the following subsections:“(1) A person shall be guilty of an offence if the person —

makes a request under section 21(1) to obtain access to personal data about another individual without the authority of that other individual;

makes a request under section 22(1) to change personal data about another individual without the authority of that other individual; or

subject to subsection (1A), gives a porting organisation a data porting request under section 26H(1) to transmit personal data about another individual to a receiving organisation without the authority of that other individual.(1A) Subsection (1)(c) does not apply to an individual who gives a data porting request under section 26H(1), in the individual’s personal or domestic capacity, to transmit any user activity data or user‑provided data about the individual even though the user activity data or user‑provided data (as the case may be) includes personal data about another individual.”;

by deleting the word “or” at the end of paragraph (b) of subsection (3), and by inserting immediately thereafter the following paragraphs:“(ba)without reasonable excuse, neglects or refuses to provide any information or produce any document which the organisation or person is required by or under this Act to provide or produce to the Commission or an inspector;

by inserting, immediately after “$5,000” in subsection (4)(a), the words “or to imprisonment for a term not exceeding 12 months or to both”; and

by inserting, immediately after subsection (5), the following subsection:“(6) An organisation or a person that commits an offence under subsection (3)(ba) or (bb) is liable —

in the case of an individual — to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 6 months or to both; and

in any other case — to a fine not exceeding $10,000.”.