Section 29: Unlawful disclosure of personal data
repealed (no longer in force). juris shows the text as it was consolidated; it does not confirm that this is the law in force today. The records juris holds show this law as repealed.
29. Unlawful disclosure of personal data
(1) Any data controller who, without lawful excuse, discloses personal
data in any manner that is incompatible with the purposes for which such
data has been collected shall commit an offence.
(2) Any data processor who, without lawful excuse, discloses personal
data processed by him without the prior authority of the data controller on
whose behalf such data is or has been processed shall commit an offence.
(3) Subject to subsection (4), any person who—
(a) obtains access to personal data, or obtains any information constituting such data, without prior authority of the data controller
or data processor by whom such data is kept; and
(b) discloses the data or information to another person,
shall commit an offence.
(4) Subsection (3) shall not apply to a person who is an employee or
agent of a data controller or processor and is acting within his mandate.
(5) Any person who offers to sell personal data where such personal data
has been obtained in breach of subsection (1) shall commit an offence.
(6) For the purposes of subsection (5), an advertisement indicating that
personal data is or may be for sale constitutes an offer to sell the personal
data.
(S. 29 came into operation on 16 February 2009.)