A person to whom personal information was disclosed because of Part IIIC Division 5 commits an offence (60 penalty units or 1 year, or both) if they subsequently disclose it, unless the disclosure is permitted for an APP entity by an APP, a binding registered APP code or a TFN rule, is for a State's constitutional functions, is for legal advice on the Division, is permitted under s 26XB, is made with the individual's consent, is to the individual, is to a court or tribunal, or is prescribed by regulations; the defendant bears an evidential burden on these exceptions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.