§ 51 — Offences and penalties

51.—(1) A person shall be guilty of an offence if the person —(a)

makes a request under section 21(1) to obtain access to personal data about another individual without the authority of that other individual;

(b)

makes a request under section 22(1) to change personal data about another individual without the authority of that other individual; or

(c)

subject to subsection (1A), gives a porting organisation a data porting request under section 26H(1) to transmit personal data about another individual to a receiving organisation without the authority of that other individual.[40/2020]

(1A) Subsection (1)(c) does not apply to an individual who gives a data porting request under section 26H(1), in the individual’s personal or domestic capacity, to transmit any user activity data or user‑provided data about the individual even though the user activity data or user‑provided data (as the case may be) includes personal data about another individual.[40/2020]

(2) A person guilty of an offence under subsection (1) shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 12 months or to both.

(3) An organisation or person commits an offence if the organisation or person —(a)

with an intent to evade a request under section 21 or 22, disposes of, alters, falsifies, conceals or destroys, or directs another person to dispose of, alter, falsify, conceal or destroy, a record containing —(i)

personal data; or

(ii)

information about the collection, use or disclosure of personal data;

(b)

obstructs or hinders the Commission, an inspector or an authorised officer in the performance of any function or duty, or the exercise of any power, under this Act;

(ba)

without reasonable excuse, neglects or refuses to provide any information or produce any document which the organisation or person is required by or under this Act to provide or produce to the Commission or an inspector;

(bb)

without reasonable excuse, neglects or refuses to attend before the Commission or an inspector as required by or under this Act; or

(c)

makes a statement, or provides any information or document, to the Commission, an inspector or an authorised officer under this Act, which the organisation or person knows, or ought reasonably to know, to be false or misleading in any material particular.[22/2016; 40/2020]

(4) An organisation or person that commits an offence under subsection (3)(a) is liable —(a)

in the case of an individual, to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 12 months or to both; and

(b)

in any other case, to a fine not exceeding $50,000.[40/2020]

(5) An organisation or person that commits an offence under subsection (3)(b) or (c) is liable —(a)

in the case of an individual, to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 12 months or to both; and

(b)

in any other case, to a fine not exceeding $100,000.

(6) An organisation or a person that commits an offence under subsection (3)(ba) or (bb) is liable —(a)

in the case of an individual — to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 6 months or to both; and

(b)

in any other case — to a fine not exceeding $10,000.[40/2020]

—(1) A person shall be guilty of an offence if the person —(a)

makes a request under section 21(1) to obtain access to personal data about another individual without the authority of that other individual;

(b)

makes a request under section 22(1) to change personal data about another individual without the authority of that other individual; or

(c)

subject to subsection (1A), gives a porting organisation a data porting request under section 26H(1) to transmit personal data about another individual to a receiving organisation without the authority of that other individual.[40/2020]

(1A) Subsection (1)(c) does not apply to an individual who gives a data porting request under section 26H(1), in the individual’s personal or domestic capacity, to transmit any user activity data or user‑provided data about the individual even though the user activity data or user‑provided data (as the case may be) includes personal data about another individual.[40/2020]

(2) A person guilty of an offence under subsection (1) shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 12 months or to both.

(3) An organisation or person commits an offence if the organisation or person —(a)

with an intent to evade a request under section 21 or 22, disposes of, alters, falsifies, conceals or destroys, or directs another person to dispose of, alter, falsify, conceal or destroy, a record containing —(i)

personal data; or

(ii)

information about the collection, use or disclosure of personal data;

(b)

obstructs or hinders the Commission, an inspector or an authorised officer in the performance of any function or duty, or the exercise of any power, under this Act;

(ba)

without reasonable excuse, neglects or refuses to provide any information or produce any document which the organisation or person is required by or under this Act to provide or produce to the Commission or an inspector;

(bb)

without reasonable excuse, neglects or refuses to attend before the Commission or an inspector as required by or under this Act; or

(c)

makes a statement, or provides any information or document, to the Commission, an inspector or an authorised officer under this Act, which the organisation or person knows, or ought reasonably to know, to be false or misleading in any material particular.[22/2016; 40/2020]

(4) An organisation or person that commits an offence under subsection (3)(a) is liable —(a)

in the case of an individual, to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 12 months or to both; and

(b)

in any other case, to a fine not exceeding $50,000.[40/2020]

(5) An organisation or person that commits an offence under subsection (3)(b) or (c) is liable —(a)

in the case of an individual, to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 12 months or to both; and

(b)

in any other case, to a fine not exceeding $100,000.

(6) An organisation or a person that commits an offence under subsection (3)(ba) or (bb) is liable —(a)

in the case of an individual — to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 6 months or to both; and

(b)

in any other case — to a fine not exceeding $10,000.[40/2020]