(1)
An agency that, without reasonable excuse, fails to notify the Commissioner of a notifiable privacy breach under section 114 commits an offence and is liable on conviction to a fine not exceeding $10,000.
(2)
It is not a defence to a charge under this section that the agency has taken steps to address the privacy breach.
(3)
It is a defence to a charge under this section that the agency did not consider the privacy breach to be a notifiable privacy breach, but only if it was reasonable to do so in the circumstances.