120Liability for actions of officers, employees, agents, and members of agencies

1. This section applies to processes and proceedings under this Act relating to the obligations under section 114 or 115.

2. An officer, an employee, or a member of an agency is not liable in those processes or proceedings if anything done or omitted by them results in the employer or agency failing to notify the Commissioner or an affected person (or their representative) or give public notice of a notifiable privacy breach.

3. For the purpose of those processes and proceedings, anything done or omitted by an officer, an employee, or a member of an agency is to be treated as being done or omitted by the employer or agency.

4. For the purpose of those processes and proceedings, anything done or omitted by an agent of another agency is to be treated as being done or omitted by both the agent and the principal agency.

5. However, the extent of liability of an agent is affected by whether they hold personal information that is the subject of a notifiable privacy breach. See the definition of privacy breach in section 112 and see section 11, which applies and which provides that information held by an agent is to be treated as being held by the principal agency unless section 11(3) applies.

6. For the purposes of subsections (4) and (5), a person (A) is an agent of an agency (B) if A holds information for or on behalf of B (for example, as a representative or an agent of B, or for safe custody or processing on behalf of B).