Section 42: Unlawful disclosure of personal data
as enacted (not consolidated). juris shows this Act from a copy that is not the official consolidation, so it may not carry every amendment; the amendments juris holds are listed. It does not confirm that this is the law in force today.
42. Unlawful disclosure of personal data
(1) Any controller who, without lawful excuse, discloses personal
data in any manner that is incompatible with the purpose for which such
data has been collected shall commit an offence.
(2) Any processor who, without lawful excuse, discloses personal
data processed by him without the prior authority of the controller on
whose behalf the data are being or have been processed shall commit an
offence.
(3) Subject to subsection (4), any person who –
(a) obtains access to personal data, or obtains any
information constituting such data, without the prior
authority of the controller or processor by whom the
data are kept; and
508 Acts 2017 Acts 2017 509
(b) discloses the data or information to another person,
shall commit an offence.
(4) Subsection (3) shall not apply to a person who is an employee
or agent of a controller or processor and is acting within his mandate.
(5) Any person who offers to sell personal data where such
personal data has been obtained in breach of subsection (1) shall commit
an offence.
(6) For the purpose of subsection (5), an advertisement indicating
that personal data is or may be for sale constitutes an offer to sell the
personal data.