(1) A data controller shall not without lawful authority disclose personal data in any manner that is incompatible with the purposes for which the personal data has been collected.
(2) A person, other an employee or agent of a data controller acting within his or her mandate, shall not —
(a) obtain access to personal data, or obtain any information constituting such personal data, without the prior authority of the data controller by whom the personal data is kept; and
(b) disclose the personal data or information to another person.
(3) A person shall not offer to sell personal data where that personal data has been obtained in contravention of this section.
(4) For the purposes of subsection (3), an advertisement indicating that personal data is or may be for sale, constitutes an offer to sell the personal data.
(5) A person who contravenes this section commits an offence and is liable on summary conviction to a fine not exceeding $25,000 or to a term of imprisonment not exceeding 6 months or to both.