Clause 67

cease to retain any health information or relevant information, or remove the means by which health information or relevant information can be associated with any particular individual, as soon as it is reasonable to assume that —

the purpose for which the information was collected is no longer being served by retention of the information; and

retention is no longer necessary for legal or business purposes; and

take reasonable care, in relation to the disposal or destruction of any health information or relevant information, to prevent unauthorised access, disclosure or reproduction of the information.

cease to retain any health information collected or processed on behalf of and for the purposes of the contributor or user (as the case may be), or remove the means by which the health information can be associated with any particular individual, as soon as it is reasonable to assume that —

the purpose for which the health information was collected or processed is no longer being served by retention of the health information; and

retention is no longer necessary for legal or business purposes; and

take reasonable care, in relation to the disposal or destruction of any health information, to prevent unauthorised access, disclosure or reproduction of the health information.

in the case of an individual, to a fine not exceeding $200,000 or to imprisonment for a term not exceeding 2 years or to both; or

in any other case, to a fine not exceeding $1 million.