s 27 Duty to protect health information and human biological material against loss, unauthorised disclosure, etc.
27.—(1) Every person who has obtained individually‑identifiable information or human biological material for the purposes of human biomedical research must take all reasonable steps and safeguards as may be necessary, including rendering information or material non‑identifiable, to protect such information or material against accidental or unlawful loss, modification or destruction, or unauthorised access, disclosure, copying, use or modification. (2) Any person who contravenes subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 12 months or to both. (3) In this section and section 28, the act of rendering information or material non‑identifiable means the removal of identifying details from the information or material so that the identity of the research subject from whom the information or material was obtained cannot be readily discovered or ascertained by a person who subsequently accesses or receives the information or material.