Unlawful obtaining of personal data

94.(1) A person shall not knowingly or recklessly, without the consent of the data controller

(a) obtain or disclose personal data or the information contained in personal data; or

(b) procure the disclosure to another person of the information contained in personal data.

(2) Subsection (1) does not apply to a person who shows that

(a) the obtaining, disclosing or procuring

(i) was necessary for the purpose of preventing or detecting crime; or

(ii) was required or authorised by or under any enactment, by any rule of law or by the order of a court of competent jurisdiction;

(b) he acted in the reasonable belief that he had in law, the right to obtain or disclose the data or information or, as the case may be, to procure the disclosure of the information to the other person;

(c) he acted in the reasonable belief that he would have had the consent of the data controller, if, the data controller had known of the obtaining, disclosing or procuring and the circumstances of it; or

(d) in the particular circumstances, the obtaining, disclosing or procuring was justified as being in the public interest.

(3) A person who, contravenes subsection (1), is guilty of an offence and is liable on summary conviction to a fine of $10 000 or to a term of imprisonment of 6 months or to both.

(4) A person who sells personal data is guilty of an offence if he obtained the data in contravention of subsection (1) and is liable on summary conviction to a fine of $100 000 or to a term of imprisonment of 3 years or to both.

(5) A person who offers to sell personal data is guilty of an offence where

(a) he has obtained the data in contravention of subsection (1); or

(b) he subsequently obtains the data in contravention of subsection (1)

and is liable on summary conviction to a fine of $100 000 or to a term of imprisonment of 3 years or to both.

(6) For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the data.