Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences

Section 24 establishes the Information Commission as a body corporate of three members appointed by the Governor-General on the Prime Minister's recommendation in consultation with the Leader of the Opposition, and section 25 gives it the functions of monitoring and advising public and private bodies, receiving and investigating complaints, education, and research and reporting to the Minister.

Section 29 lets the Commission investigate, on a data subject's complaint or on its own initiative, whether a public or private body has contravened, is contravening or is likely to contravene the Act, and sections 30 to 32 govern the form of a complaint, the notice of investigation served on the Chief Executive Officer, and the information notice by which the Commission may compel a data user to furnish access to personal data and information about its processing and security.

Section 33 lets a Magistrate issue a warrant authorising an authorised officer to enter and search premises, inspect and test equipment, and seize documents where there are reasonable grounds to suspect an offence under the Act.

Section 34 lets the Commission serve an enforcement notice requiring a public or private body to rectify or erase personal data or supplement it with an approved statement, and requires the body, once it complies in a way that materially modifies the data, to notify the data subject and anyone the data was disclosed to in the twelve months before the notice.

Section 35 lets the Commission assess a body's processing for compliance, on its own initiative or on a request from a person affected by it, and report its findings and any direction to comply. Section 36 lets a data subject who suffers damage from a contravention of the Act by a public or private body bring civil proceedings in the High Court, subject to a defence that the body took all care reasonably required to comply.

Section 37 makes it an offence, punishable summarily by a fine not exceeding five thousand dollars or imprisonment not exceeding six months, to obstruct the Commission or an authorised officer, and section 38 bars an employer from retaliating against an employee who in good faith reports or refuses to take part in a contravention of the Act.

Section 39 makes it an offence to intentionally disclose personal information in contravention of the Act, or to collect, store or dispose of it in a way that contravenes the Act, section 40 makes it an offence to breach the whistleblower protection in section 38, and section 41 makes an officer, director or agent of a corporation who directed, authorised, assented to or participated in an offence a party to that offence.

Section 42 sets the default penalty for an offence with no penalty otherwise specified: for an individual, a fine not exceeding fifty thousand dollars or imprisonment not exceeding three years on summary conviction, or a fine not exceeding one hundred thousand dollars or imprisonment not exceeding five years on conviction on indictment, and for a body corporate, a fine not exceeding two hundred and fifty thousand dollars on summary conviction or five hundred thousand dollars on conviction on indictment.

Section 43 gives a right of appeal to the High Court against an enforcement or information notice, a decision on a complaint, or any decision of the Commission on the conduct of its duties, section 46 bars a Commission member or person acting for it from disclosing information obtained in the conduct of their functions except by court order, and section 47 requires the Commission to report annually to Parliament on its activities.