267.Section 76 makes it a criminal offence for any person, including a member or employee of the Commission, knowingly or recklessly to disclose confidential information which has been obtained by the Commission and which identifies an individual, during the lifetime of the individual. The penalty on summary conviction is imprisonment of up to 12 months, or a fine not exceeding the statutory maximum, or both. The penalty on conviction on indictment is imprisonment of up to 2 years, or an unlimited fine, or both. The section applies to all of the Commission’s functions, whereas under the existing law a similar provision only applies to CHAI as the regulator of health services.
268.Subsections (1) to (3) of section 77 set out defences to a charge under section 76. It is a defence to prove that any of the circumstances listed in subsection (2) (for example, that the form of disclosure meant that the individual was not identified or the individual concerned had given their consent to the information being made available) applied or that the person charged reasonably believed they applied. It is also a defence to prove that the disclosure was made for a purpose in subsection (3), for example, in connection with a criminal investigation. Subsection (4) requires that, where someone offers one of these defences in response to a charge brought under section 76 and evidence is adduced which is sufficient to raise an issue with respect to the defence, the defence is to be regarded as satisfied unless the prosecution proves beyond reasonable doubt that it is not.