Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 (Qld)

Queensland Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 Subordinate Legislation 2008 No. 114 made under the Transport Operations (Road Use Management) Act 1995 Contents Page 1 Short title . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2 Commencement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3 Regulation amended . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 4 Amendment of s 48 (Guidelines for safe movement of vehicles) . 5 5 Amendment of s 51 (Permits for safe movement of vehicles) . . . 5 6 Insertion of new pt 6, div 3 and pt 6A . . . . . . . . . . . . . . . . . . . . . . 6 Division 3 IAP conditions and procedure before operating under IAP etc. 55A IAP conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 55B Procedure to obtain certificate relating to IAP vehicle 7 55C Notice of change of information contained in request 8 55D Notice that operator no longer wants to operate vehicle under IAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Part 6A Intelligent access program Division 1 Preliminary 55E What this part is about . . . . . . . . . . . . . . . . . . . . . . . . 9 55F Meaning of malfunctions . . . . . . . . . . . . . . . . . . . . . . 9 55G Meaning of noncompliance report . . . . . . . . . . . . . . . 10

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 Contents Page 2 Division 2 Powers and duties of chief executive in relation to IAP 55H Issue of IAP identifiers . . . . . . . . . . . . . . . . . . . . . . . . Division 3 Duties and obligations of operators of IAP vehicles 55I Operator of an IAP vehicle providing false or misleading information to IAP service provider . . . . . 55J Participating operators’ obligation to tell IAP vehicle drivers about collection of personal information and other matters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55K System malfunctions—obligations of participating operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Division 4 Obligations of IAP vehicle drivers 55L System malfunctions—obligations of IAP vehicle drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Division 5 Duties, powers and obligations of IAP service providers 55M IAP service providers’ duties in relation to use and disclosure of IAP information . . . . . . . . . . . . . . . . . . . 55N IAP service providers’ powers to collect information that will become IAP information and hold, store, use and disclose IAP information . . . . . . . . . . . . . . . . . . . 55O IAP service provider must give IAP auditor and TCA access to record . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55P IAP service providers’ duties in relation to recording use and disclosure of IAP information . . . . . . . . . . . . 55Q IAP service providers’ obligations relating to quality and security of IAP information . . . . . . . . . . . . . . . . . 55R IAP service providers’ obligations relating to records of monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55S IAP service providers’ obligation to make individuals aware of personal information held . . . . . . . . . . . . . . 55T IAP service providers’ obligation to give noncompliance reports . . . . . . . . . . . . . . . . . . . . . . . . 55U IAP service providers’ obligations relating to reporting tampering . . . . . . . . . . . . . . . . . . . . . . . . . . 55V IAP service providers’ obligation to report malfunctions ........................... 55W IAP service provider providing false or misleading information to TCA or IAP auditor . . . . . . . . . . . . . . . Division 6 Functions, powers and obligations of TCA 55X Failure to comply with particular provisions not an offence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 10 12 13 14 14 15 16 16 17 18 19 21 21 23 25 26 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 Contents 55Y Functions of TCA . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55Z TCA’s duties in relation to use and disclosure of IAP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55ZA TCA’s powers to collect information that will become IAP information and hold, store, use and disclose IAP information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55ZB Use of IAP information for research . . . . . . . . . . . . . . 55ZC TCA’s obligations in relation to collecting IAP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55ZD TCA’s obligations to keep IAP information secure and destroy IAP information . . . . . . . . . . . . . . . . . . . . 55ZE TCA’s obligation to make individuals aware of personal information held . . . . . . . . . . . . . . . . . . . . . . 55ZF TCA’s obligation to keep records relating to its transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55ZG TCA’s obligation to correct errors etc. . . . . . . . . . . . . 55ZH TCA’s obligations relating to reporting tampering or malfunction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Division 7 Duties, powers and obligations of IAP auditors 55ZI What IAP audit is . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55ZJ IAP auditors’ duties in relation to use and disclosure of IAP information. . . . . . . . . . . . . . . . . . . . . . . . . . . . 55ZK IAP auditors’ powers to collect information that will become IAP information and hold, store, use and disclose IAP information. . . . . . . . . . . . . . . . . . . . . . . 55ZL IAP auditors’ obligations in relation to collecting IAP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55ZM IAP auditors’ obligations to keep IAP information secure and destroy or remove personal information . 55ZN IAP auditors’ obligation to make individuals aware of personal information held . . . . . . . . . . . . . . . . . . . . . . 55ZO IAP auditors’ obligation to keep records of transactions ........................... 55ZP IAP auditors’ obligation to correct errors etc. . . . . . . . 55ZQ IAP auditors’ obligation to report breaches by IAP service providers . . . . . . . . . . . . . . . . . . . . . . . . . 55ZR IAP auditors’ obligation to report tampering . . . . . . . . Division 8 Tampering with approved intelligent transport systems 55ZS Meaning of tampers . . . . . . . . . . . . . . . . . . . . . . . . . . 26 26 28 29 29 30 30 32 32 32 34 34 36 37 37 38 39 40 41 41 41 2008 SL No. 114 Page 3

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 Contents 55ZT Tampering with approved intelligent transport system 7 Amendment of sch 11 (Dictionary) . . . . . . . . . . . . . . . . . . . . . . . . 42 42 Page 4 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 1] 1 Short title This regulation may be cited as the Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 . 2 Commencement This regulation commences on 15 May 2008. 3 Regulation amended This regulation amends the Transport Operations (Road UseManagement—Mass,DimensionsandLoading)Regulation2005. 4 Amendment of s 48 (Guidelines for safe movement of vehicles) (1) Section 48(3)(j)— renumber as section 48(3)(k). (2) Section 48(3)— insert— ‘(j) operating the type of vehicle under the IAP;’. (3) Section 48— insert— ‘(5) If a guideline relates to operating a type of vehicle under the IAP, the guideline must state that the operator of a vehicle of that type must obtain a certificate under section 55B before operating the vehicle under the IAP.’. 5 Amendment of s 51 (Permits for safe movement of vehicles) (1) Section 51(5)(b), (c), (d), (e), (f), (g), (i), (j) and (6), after ‘the vehicle’— insert — 2008 SL No. 114 Page 5

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘or type of vehicle’. (2) Section 51(5)(j)— renumber as section 51(5)(k). (3) Section 51(5)— insert— ‘(j) operating the vehicle or type of vehicle under the IAP;’. (4) Section 51— insert— ‘(7) If a permit relates to operating a vehicle, or type of vehicle, under the IAP, the permit must state that the operator of the vehicle, or a vehicle of that type, must obtain a certificate under section 55B before operating the vehicle under the IAP.’. 6 Insertion of new pt 6, div 3 and pt 6A After section 55— insert— ‘Division 3 IAP conditions and procedure before operating under IAP etc. ‘55A IAP conditions ‘(1) This section applies if— (a) a guideline relates to operating a type of vehicle under the IAP; or (b) a permit relates to operating a vehicle or type of vehicle under the IAP. ‘(2) The IAP conditions for vehicles operating under the IAP are— (a) the conditions stated in schedule 8 for the guideline or permit; and Page 6 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (b) the conditions stated in the guideline or permit about a heavy vehicle’s access, or improved access, to the road network under the IAP. ‘(3) The IAP conditions— (a) must state at least 1 IAP road ( spatial data ); and (b) may state 1 or more of the following— (i) periods during which IAP vehicles are permitted to use the stated IAP road ( temporal data ); (ii) maximum speeds at which IAP vehicles may travel during that use ( speed data ); (iii) any other condition of access to the IAP road, for example, a condition about mass limits. ‘(4) If the IAP conditions do not state speed data, the IAP conditions are taken to authorise the use of IAP vehicles on the IAP road at any speed at which a non-IAP vehicle of the same class could be used on the IAP road. ‘(5) If the IAP conditions state speed data, the IAP conditions do not authorise an IAP vehicle to travel at a speed in excess of a speed limit that applies to vehicles generally. ‘(6) If the IAP conditions do not state temporal data, the IAP conditions are taken to authorise the use of IAP vehicles on the IAP road at any time at which a non-IAP vehicle of the same class could be used on the IAP road. ‘(7) The IAP conditions may require an IAP vehicle to be monitored whether or not it uses an IAP road. ‘(8) In this section— IAP road means a road or road-related area for use by an IAP vehicle. ‘55B Procedure to obtain certificate relating to IAP vehicle ‘(1) This section applies if— 2008 SL No. 114 Page 7

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) under section 48(5), the operator of a vehicle of a particular type must obtain a certificate under this section before operating the vehicle under the IAP; or (b) under section 51(7), the operator of a vehicle, or a vehicle of a particular type, must obtain a certificate under this section before operating the vehicle under the IAP. ‘(2) The operator of the vehicle must give the chief executive a request, in the approved form, for a notice from the chief executive stating that the operator may enter into an IAP agreement for the vehicle. ‘(3) The approved form may be combined with the approved forms under sections 55C and 55D. ‘(4) If the operator of the vehicle gives the chief executive a request under subsection (2) for the vehicle, the chief executive must give the operator a written notice stating that the operator may enter into an IAP agreement for the vehicle. ‘(5) After the operator of the vehicle has received written notice under subsection (4), the operator may enter into an IAP agreement for the vehicle. ‘(6) If an IAP service provider gives the chief executive written notice that the IAP service provider has entered into an IAP agreement with the operator of the vehicle, the chief executive must give the operator a certificate under subsection (7) for the vehicle. ‘(7) The certificate must— (a) identify the IAP conditions to which the vehicle is subject, by reference to the guideline or permit; and (b) state the effect of section 55A(4) and (6). ‘55C Notice of change of information contained in request ‘If there is a change in any of the information contained in a request under section 55B(2) made by the operator of a vehicle, the operator must give the chief executive notice in Page 8 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] the approved form of the change within 14 days after the change. Maximum penalty—20 penalty units. ‘55D Notice that operator no longer wants to operate vehicle under IAP ‘(1) The operator of an IAP vehicle may give the chief executive notice, in the approved form, that the operator no longer wants to operate the vehicle under the IAP. ‘(2) On receipt of the notice by the chief executive, the operator can no longer operate the vehicle under the IAP. ‘(3) Subsection (2) applies despite anything stated in this regulation or a guideline or permit under part 6. ‘Part 6A Intelligent access program ‘Division 1 Preliminary ‘55E What this part is about ‘This part states the powers, functions, duties and obligations applying to a person in relation to the IAP. ‘55F Meaning of malfunctions ‘An approved intelligent transport system malfunctions if— (a) it ceases to work at all, or works only intermittently; or (b) it does not perform a function required under the IAP, or performs the function only intermittently; or (c) it performs a function required under the IAP in a way that the results of it doing so are inaccurate or 2008 SL No. 114 Page 9

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] unreliable, including intermittently inaccurate or unreliable. ‘55G Meaning of noncompliance report ‘(1) A noncompliance report is a report, made by an approved intelligent transport system, of a contravention by an IAP vehicle of the IAP conditions. ‘(2) A noncompliance report may include information generated by an approved intelligent transport system about apparent tampering with, or malfunctioning of, the system. ‘Division 2 Powers and duties of chief executive in relation to IAP ‘55H Issue of IAP identifiers ‘(1) The chief executive may issue an IAP identifier for an IAP vehicle. ‘(2) If an IAP identifier is, or becomes, known to a person or entity that has the ability to associate it with a particular individual, the person or entity must treat the identifier as personal information for the purposes of a law relating to privacy. ‘Division 3 Duties and obligations of operators of IAP vehicles ‘55I Operator of an IAP vehicle providing false or misleading information to IAP service provider ‘(1) The operator of an IAP vehicle commits an offence if— (a) the operator gives information to an IAP service provider with whom the operator has entered into an IAP agreement; and (b) the information is relevant to the operation of the IAP vehicle; and Page 10 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (c) the operator knows, or could reasonably be expected to know, the information is false or misleading in a material particular. Maximum penalty—80 penalty units. ‘(2) Subsection (1) does not apply if the operator gives the information in writing and, when giving the information— (a) tells the IAP service provider, to the best of the operator’s ability, how it is false or misleading; and (b) if the operator has, or can reasonably obtain, the correct information—gives the correct information in writing. ‘(3) Without limiting subsection (1)(b), information about the IAP conditions that apply, or are capable of applying, to an IAP vehicle is relevant to the operation of the IAP vehicle. ‘(4) The operator of a vehicle commits an offence if— (a) the operator gives information to an IAP service provider; and (b) the operator intends that the IAP service provider will enter into an IAP agreement with the operator in reliance on the information; and (c) the operator knows, or could reasonably be expected to know, the information is false or misleading in a material particular. Maximum penalty—80 penalty units. ‘(5) Subsection (4) does not apply if the operator gives the information in writing and, when giving the information— (a) tells the IAP service provider, to the best of the operator’s ability, how it is false or misleading; and (b) if the operator has, or can reasonably obtain, the correct information—gives the correct information in writing. ‘(6) It is enough for a complaint against an operator for an offence against subsection (1) or (4) to state that the information given was false or misleading to the operator’s knowledge. 2008 SL No. 114 Page 11

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘55J Participating operators’ obligation to tell IAP vehicle drivers about collection of personal information and other matters ‘(1) A participating operator who operates an IAP vehicle must take reasonable steps to give the IAP vehicle’s driver the following information, before the IAP vehicle begins a journey— (a) that the IAP vehicle will be monitored by an IAP service provider; (b) the information that will be collected by the IAP service provider; (c) the purposes for which the information will be collected; (d) the persons and entities to whom the information collected may be disclosed; (e) that the collection of the information is authorised under this part; (f) that, under this part, the driver has rights of access to the information or to have the information changed to ensure it is accurate, up-to-date and complete; (g) how the rights mentioned in paragraph (f) can be exercised; (h) the name and address of the IAP service provider. Maximum penalty—80 penalty units. ‘(2) A participating operator who operates an IAP vehicle must take reasonable steps to tell the IAP vehicle’s driver before the IAP vehicle begins a journey— (a) about the IAP vehicle driver’s obligation under section 55L; and (b) how the IAP vehicle driver can make the reports required by that obligation. Maximum penalty—80 penalty units. ‘(3) A participating operator who operates an IAP vehicle is taken to comply with subsections (1) and (2) if the operator— Page 12 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) places a notice that gives the information mentioned in subsections (1) and (2) in a place in the IAP vehicle’s driving cab where it is clearly visible; or (b) gives the information mentioned in subsections (1) and (2) to the IAP vehicle’s driver in writing as part of a written contract of employment between the IAP vehicle driver and the participating operator. ‘(4) TCA may approve— (a) a form of notice that may be used under subsection (3)(a); and (b) for subsection (3)(b), a standard form of words that may be used as part of a written contract of employment. ‘(5) If TCA approves a form of notice that may be used under subsection (3)(a), TCA must make the form available on the IAP website. ‘(6) If TCA approves a standard form of words as mentioned in subsection (4)(b), TCA must make the standard form of words available on the IAP website. ‘55K System malfunctions—obligations of participating operators ‘(1) If a participating operator who operates an IAP vehicle becomes aware that an approved intelligent transport system fitted to the IAP vehicle is malfunctioning, the participating operator must immediately report the malfunction to the chief executive in person or by telephone, fax or email. Maximum penalty—50 penalty units. ‘(2) The participating operator must keep, for at least 4 years, a written record of a report of a malfunction under subsection (1), containing the following particulars— (a) the type of malfunction to which the report relates; (b) the date and time the person making the report became aware of the malfunction; 2008 SL No. 114 Page 13

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (c) the location of the vehicle when the person making the report became aware of the malfunction; (d) the date and time the report was made; (e) the location of the vehicle when the report was made; (f) the way, by telephone, fax, email or in person, that the report was made; (g) the name of the individual who made the report; (h) the name of the individual to whom the report was made. Maximum penalty—50 penalty units. ‘Division 4 Obligations of IAP vehicle drivers ‘55L System malfunctions—obligations of IAP vehicle drivers ‘If the driver of an IAP vehicle becomes aware that an approved intelligent transport system fitted to the IAP vehicle is malfunctioning, the driver must immediately report the malfunction to the IAP vehicle’s participating operator in person or by radio, telephone, fax or email. Maximum penalty—50 penalty units. ‘Division 5 Duties, powers and obligations of IAP service providers ‘55M IAP service providers’ duties in relation to use and disclosure of IAP information ‘An IAP service provider must not use or disclose IAP information other than as required or authorised under this regulation or another law. Maximum penalty—80 penalty units. Page 14 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘55N IAP service providers’ powers to collect information that will become IAP information and hold, store, use and disclose IAP information ‘(1) An IAP service provider may, for compliance purposes— (a) collect information that when collected will become IAP information; and (b) hold, store and use IAP information. ‘(2) An IAP service provider may disclose IAP information to the chief executive, or to TCA, for compliance purposes. ‘(3) With the consent of a participating operator, an IAP service provider may disclose IAP information about the participating operator to a person other than the participating operator for any purpose if the information— (a) does not identify any individual; and (b) contains nothing by which the identity of any individual can reasonably be found out. ‘(4) An IAP service provider may disclose IAP information, other than the following information, about a participating operator to the participating operator— (a) a report under section 55U; (b) information that a report under section 55U has been made; (c) any information from which the participating operator could reasonably infer that a report under section 55U has been made. ‘(5) Also, an IAP service provider may use or disclose IAP information— (a) if the IAP information is personal information—with the consent of the individual that the personal information is about; or (b) as otherwise authorised by this regulation or any other law. ‘(6) In this section— compliance purposes means— 2008 SL No. 114 Page 15

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) deciding whether a transport Act or an alternative compliance scheme has been contravened; or (b) checking compliance with a transport Act or an alternative compliance scheme. Example of checking compliance with a transport Act — checking whether a person is driving in accordance with a guideline or permit issued under part 6 ‘55O IAP service provider must give IAP auditor and TCA access to record ‘An IAP service provider must give an IAP auditor and TCA access to a record kept by the IAP service provider for the purposes of this part. Maximum penalty—80 penalty units. ‘55P IAP service providers’ duties in relation to recording use and disclosure of IAP information ‘(1) If an IAP service provider uses or discloses IAP information, other than in relation to the IAP or for law enforcement purposes, the IAP service provider must make a record of the use or disclosure in a way complying with subsection (2) and containing the following information— (a) the name of the person who used or disclosed the IAP information; (b) the date of the use or disclosure; (c) for a use of IAP information by the IAP service provider, a brief description of how the information was used; (d) for a disclosure of IAP information by the IAP service provider, the person or entity to whom the information was disclosed; (e) the provision of this regulation or the other law that authorised the use or disclosure; Page 16 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (f) if the use or disclosure is authorised only with a particular document, for example, a warrant, a certificate or a consent, a copy of the document. Maximum penalty—80 penalty units. ‘(2) An IAP service provider must make a record under subsection (1)— (a) within 5 business days after the relevant use or disclosure; and (b) in a form that allows the record to be readily inspected. ‘(3) An IAP service provider must keep a record made under subsection (1) for at least 2 years. Maximum penalty for subsection (3)—80 penalty units. ‘55Q IAP service providers’ obligations relating to quality and security of IAP information ‘(1) An IAP service provider must take reasonable steps to ensure that the IAP information the IAP service provider collects— (a) is necessary for, or is directly related to, the purpose for which it is collected, or a directly related purpose; and (b) is not excessive for that purpose; and (c) is accurate, up-to-date and complete. Maximum penalty—50 penalty units. ‘(2) An IAP service provider must take reasonable steps to ensure that the collection of IAP information does not intrude to an unreasonable extent on the personal privacy of any individual to whom the information relates. Maximum penalty—50 penalty units. ‘(3) If asked by an individual about whom an IAP service provider holds personal information to make a particular change to the personal information, the IAP service provider must make the change if it is satisfied the change is appropriate to ensure the personal information is accurate, up-to-date and complete. Maximum penalty—50 penalty units. 2008 SL No. 114 Page 17

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘(4) If an IAP service provider is not satisfied as mentioned in subsection (3) in relation to a request under the subsection, the IAP service provider may refuse to comply with the request. ‘(5) If, under subsection (4), an IAP service provider refuses to comply with an individual’s request under subsection (3), the IAP service provider must— (a) give the individual a written statement of the IAP service provider’s reasons for refusing; and (b) if asked by the individual, attach to or include with the personal information the request or a record of the request. Maximum penalty for subsection (5)—50 penalty units. ‘55R IAP service providers’ obligations relating to records of monitoring ‘(1) An IAP service provider must keep, in a way complying with subsection (2), records of the IAP information that the IAP service provider collects. Maximum penalty—80 penalty units. ‘(2) Records kept under subsection (1) must be organised in a way that allows the records to be conveniently and properly audited. ‘(3) An IAP service provider must keep— (a) a copy of a noncompliance report made by an approved intelligent transport system used by the IAP service provider; and (b) the information that was relied on to make the report; for at least 4 years after the report is made. Example of information that was relied on to make the report — GPS information about a vehicle’s position at a particular time Maximum penalty—80 penalty units. ‘(4) An IAP service provider must take reasonable steps to protect IAP information collected by the IAP service provider against Page 18 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] unauthorised access, unauthorised use, misuse, loss, modification or unauthorised disclosure. Maximum penalty—80 penalty units. ‘(5) An IAP service provider must take reasonable steps to destroy IAP information held by the IAP service provider, other than information required to be kept under subsection (3), 1 year after the information is collected by the IAP service provider. Maximum penalty for subsection (5)—80 penalty units. ‘55S IAP service providers’ obligation to make individuals aware of personal information held ‘(1) An IAP service provider must prepare, and make publicly available, a document that sets out its policies on the management of personal information held by it. Examples of how a document is made publicly available — • making a document available at an office of the IAP service provider • making a document available on the IAP service provider’s website Maximum penalty—80 penalty units. ‘(2) If asked by an individual about whom an IAP service provider holds personal information, the IAP service provider must, within 28 days after receiving the request, give the individual the following information if the IAP service provider can reasonably give the information— (a) the kinds of information the IAP service provider holds about the individual; (b) the purpose for which the information is held; (c) the way in which the IAP service provider collects, holds, uses and discloses the information; (d) the persons and entities to whom the information may be disclosed; (e) that the collection of the information is authorised under this part; 2008 SL No. 114 Page 19

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (f) that, under this part, the individual has rights of access to the information or to have the information changed to ensure it is accurate, up-to-date and complete; (g) how the rights mentioned in paragraph (f) can be exercised. Maximum penalty—80 penalty units. ‘(3) An IAP service provider does not commit an offence against subsection (2) if— (a) it is not possible for the IAP service provider to give the individual the information required to be given under subsection (2) (the required information ) within 28 days after receiving the request; and (b) the IAP service provider— (i) within 28 days after receiving the request, gives the individual an interim reply that— (A) gives the individual as much of the required information as the IAP service provider can give within the 28 days; and (B) states the reason the IAP service provider can not give the individual the rest of the required information; and (C) states an estimate of how long it will take the IAP service provider to give the individual the rest of the required information; and (ii) as soon as possible after the interim reply is given to the individual, takes reasonable steps to give the individual the rest of the required information. ‘(4) An IAP service provider must, if asked by an individual about whom the IAP service provider holds personal information, give the individual access to the personal information without undue delay or cost. Maximum penalty—80 penalty units. ‘(5) Subsection (2), (3) or (4) does not require an IAP service provider— Page 20 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) to inform an individual that a report under section 55T or 55U exists or has been made; or (b) to give an individual access to the report. ‘55T IAP service providers’ obligation to give noncompliance reports ‘(1) An IAP service provider commits an offence if— (a) an approved intelligent transport system used by the IAP service provider has detected a breach by a participating operator of the IAP conditions; and (b) the IAP service provider does not give a noncompliance report complying with subsection (2) to the chief executive within the time allowed under subsection (3). Maximum penalty—80 penalty units. ‘(2) A noncompliance report given under subsection (1) must— (a) be in the form approved for the purpose by TCA; and (b) contain any information reasonably required by TCA. ‘(3) An IAP service provider must give a noncompliance report under subsection (1) within the time required by TCA. ‘(4) TCA must, as part of the certification of the IAP service provider as a service provider for the IAP, notify, in writing, the IAP service provider of the following— (a) details of the form approved for subsection (2)(a); and (b) the information required under subsection (2)(b); and (c) the time within which a noncompliance report must be given under subsection (3). ‘55U IAP service providers’ obligations relating to reporting tampering ‘(1) For subsections (2) and (3), an IAP service provider does not know or suspect an approved intelligent transport system has been tampered with only because the IAP service provider has— 2008 SL No. 114 Page 21

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) accessed a report made by an approved intelligent transport system, including a report contained in a noncompliance report, of the electronic detection of apparent tampering with the system; or (b) analysed information generated by an approved intelligent transport system. ‘(2) An IAP service provider commits an offence if the IAP service provider— (a) either— (i) knows that an approved intelligent transport system fitted to an IAP vehicle has been tampered with; or (ii) has reasonable grounds to suspect that an approved intelligent transport system fitted to an IAP vehicle has been tampered with; and (b) does not report the tampering or suspected tampering, in a way complying with subsection (4), to the chief executive immediately. Maximum penalty—80 penalty units. ‘(3) An IAP service provider commits an offence if the IAP service provider— (a) either— (i) knows that an approved intelligent transport system, other than an approved intelligent transport system fitted to an IAP vehicle, has been tampered with; or (ii) has reasonable grounds to suspect that an approved intelligent transport system, other than an approved intelligent transport system fitted to an IAP vehicle, has been tampered with; and (b) does not report the tampering or suspected tampering, in a way complying with subsection (4), to TCA immediately. Maximum penalty—80 penalty units. Page 22 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘(4) A report under subsection (2)(b) or (3)(b) must be in the form approved for the purpose by TCA, if any. ‘(5) TCA must make a form approved under subsection (4) available on the IAP website. ‘(6) If an IAP service provider knows, or has reasonable grounds to suspect, that an approved intelligent transport system has been tampered with, the IAP service provider must not disclose to any person other than the chief executive or TCA any of the following information— (a) that the IAP service provider has that knowledge or suspicion; (b) any information from which the person to whom the disclosure is made could reasonably infer that the IAP service provider has that knowledge or suspicion; unless the disclosure is authorised under another law. Maximum penalty—80 penalty units. ‘(7) If an IAP service provider has made a report to the chief executive or TCA under subsection (2) or (3) of apparent tampering or suspicion of tampering, the IAP service provider must not disclose to any person other than the chief executive or TCA any of the following information — (a) that the report has been made; (b) any information from which the person to whom the disclosure is made could reasonably infer that the IAP service provider has made the report; unless the disclosure is authorised under another law. Maximum penalty for subsection (7)—80 penalty units. ‘55V IAP service providers’ obligation to report malfunctions ‘(1) For this section, an IAP service provider does not know or suspect an approved intelligent transport system has malfunctioned only because the IAP service provider has— 2008 SL No. 114 Page 23

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) accessed a report made by an approved intelligent transport system, including a report contained in a noncompliance report, of the electronic detection of malfunctioning of the system; or (b) analysed information generated by an approved intelligent transport system. ‘(2) An IAP service provider commits an offence if the IAP service provider— (a) either— (i) knows that an approved intelligent transport system fitted to an IAP vehicle has malfunctioned; or (ii) has reasonable grounds to suspect that an approved intelligent transport system fitted to an IAP vehicle has malfunctioned; and (b) does not report the malfunction or suspected malfunction, in a way complying with subsection (4), to the chief executive immediately. Maximum penalty—80 penalty units. ‘(3) An IAP service provider commits an offence if the IAP service provider— (a) either— (i) knows that an approved intelligent transport system, other than an approved intelligent transport system fitted to an IAP vehicle, has malfunctioned; or (ii) has reasonable grounds to suspect that an approved intelligent transport system, other than an approved intelligent transport system fitted to an IAP vehicle has malfunctioned; and (b) does not report the malfunction or suspected malfunction, in a way complying with subsection (4), to TCA immediately. Maximum penalty—80 penalty units. Page 24 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘(4) A report under subsection (2)(b) or (3)(b) must be in the form approved for the purpose by TCA, if any. ‘(5) TCA must make a form approved under subsection (4) available on the IAP website. ‘55W IAP service provider providing false or misleading information to TCA or IAP auditor ‘(1) An IAP service provider commits an offence if— (a) the IAP service provider gives information to TCA or an IAP auditor; and (b) the information is relevant to a function of an IAP service provider under the IAP, including information that is relevant to the operation of an IAP vehicle; and (c) the IAP service provider knows, or could reasonably be expected to know, the information is false or misleading in a material particular. Maximum penalty—80 penalty units. ‘(2) Subsection (1) does not apply if the IAP service provider gives the information in writing and, when giving the information— (a) tells TCA or the IAP auditor, to the best of the IAP service provider’s ability, how it is false or misleading; and (b) if the IAP service provider has, or can reasonably obtain, the correct information—gives the correct information in writing. ‘(3) It is enough for a complaint against an IAP service provider for an offence against subsection (1) to state that the information given was false or misleading to the IAP service provider’s knowledge. 2008 SL No. 114 Page 25

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘Division 6 Functions, powers and obligations of TCA ‘55X Failure to comply with particular provisions not an offence ‘TCA does not commit an offence only by failing to comply with any of the following provisions— (a) section 55Z(3), (4) or (5); (b) section 55ZC(1) or (2); (c) section 55ZD(1) or (2); (d) section 55ZE(1), (2) or (4); (e) section 55ZF(1), (2), (3) or (4); (f) section 55ZG(1) or (3); (g) section 55ZH(2), (3) or (4). ‘55Y Functions of TCA ‘For this part, the functions of TCA are— (a) to manage the certification and audit regime for the IAP; and (b) to certify and audit, and repeal the certification of, IAP service providers; and (c) to engage IAP auditors to help it in its certification and audit activities. ‘55Z TCA’s duties in relation to use and disclosure of IAP information ‘(1) For section 143 of the Act, TCA may— (a) use or disclose IAP information for a purpose for which the information was collected by TCA; and (b) disclose IAP information relating to a particular participating operator to— Page 26 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (i) the participating operator; or (ii) an IAP auditor; or (iii) the chief executive; or (iv) the IAP service provider with whom the participating operator has entered into an IAP agreement; and (c) disclose IAP information relating to a breach of an IAP service provider’s obligations under division 5 or 8 to— (i) the chief executive; or (ii) an IAP auditor; and (d) disclose a noncompliance report, or a report made under section 55U or 55V, to— (i) the chief executive; or (ii) an IAP auditor; or (iii) for a noncompliance report— (A) the IAP service provider who uses the approved intelligent transport system that made the report; or (B) the participating operator who operates the vehicle to which the report relates; or (iv) for a report made under section 55U or 55V—the IAP service provider who made the report; or (v) for a report made under section 55V—the participating operator to which the report relates. ‘(2) Subsection (1) applies only if TCA is reasonably satisfied, having regard to the purpose for which the information is to be used or disclosed, that the information is accurate, up-to-date and complete. ‘(3) If TCA uses or discloses IAP information, other than in relation to the IAP or for law enforcement purposes, TCA must make a record of the use or disclosure in a way complying with subsection (4) and containing the following information— 2008 SL No. 114 Page 27

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) the name of the person who used or disclosed the IAP information; (b) the date of the use or disclosure; (c) for a use of IAP information by TCA, a brief description of how the information was used; (d) for a disclosure of IAP information by TCA, the person or entity to whom the information was disclosed; (e) the provision of this regulation or the other law that authorised the use or disclosure; (f) if the use or disclosure is authorised only with a particular document, for example, a warrant, a certificate or a consent, a copy of the document. ‘(4) TCA must make a record under subsection (3)— (a) within 5 business days after the relevant use or disclosure; and (b) in a form that allows the record to be readily inspected. ‘(5) TCA must keep a record made under subsection (3) for at least 2 years. ‘55ZA TCA’s powers to collect information that will become IAP information and hold, store, use and disclose IAP information ‘(1) TCA may collect information that when collected will become IAP information, and hold or store IAP information— (a) for the performance of its functions; and (b) for law enforcement purposes. ‘(2) For section 143 of the Act, TCA may use or disclose IAP information— (a) for the performance of its functions; and (b) for law enforcement purposes. ‘(3) For section 143 of the Act, TCA may, with the consent of a participating operator, disclose IAP information about the Page 28 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] participating operator to a person other than the participating operator for any purpose if the information— (a) does not identify any individual; and (b) contains nothing by which the identity of any individual can reasonably be found out. ‘(4) For section 143 of the Act, TCA may use or disclose IAP information— (a) if the IAP information is personal information—with the consent of the individual that the personal information is about; or (b) as otherwise authorised by this regulation or any other law. ‘55ZB Use of IAP information for research ‘For section 143 of the Act, TCA may use or disclose IAP information for research purposes, but only if the information contains no personal information. ‘55ZC TCA’s obligations in relation to collecting IAP information ‘(1) TCA must take reasonable steps to ensure that IAP information that TCA collects— (a) is necessary for, or is directly related to, the purpose for which it is collected, or a directly related purpose; and (b) is not excessive for that purpose; and (c) is accurate, up-to-date and complete. ‘(2) TCA must take reasonable steps to ensure that the collection of IAP information does not intrude to an unreasonable extent on the personal privacy of any individual to whom the information relates. 2008 SL No. 114 Page 29

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘55ZD TCA’s obligations to keep IAP information secure and destroy IAP information ‘(1) TCA must take reasonable steps to protect IAP information collected by it against unauthorised access, unauthorised use, misuse, loss, modification or unauthorised disclosure. ‘(2) TCA must take reasonable steps to destroy IAP information collected by it 1 year after the information is collected by it unless the information is required as evidence. ‘(3) TCA is taken to have complied with subsection (2) if it permanently removes anything by which an individual can be identified from the IAP information that it holds. ‘55ZE TCA’s obligation to make individuals aware of personal information held ‘(1) TCA must prepare, and make publicly available, a document that sets out its policies on the management of personal information held by it. Examples of how a document is made publicly available — • making a document available at TCA’s office • making a document available on the IAP website ‘(2) If asked by an individual about whom TCA holds personal information, it must, within 28 days after receiving the request, give the individual the following information if it can reasonably give the information— (a) the kinds of information it holds about the individual; (b) the purpose for which the information is held; (c) the way in which it collects, holds, uses and discloses the information; (d) the persons and entities to whom the information may be disclosed; (e) that the collection of the information is authorised under this part; Page 30 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (f) that, under this part, the individual has rights of access to the information or to have the information changed to ensure it is accurate, up-to-date and complete; (g) how the rights mentioned in paragraph (f) can be exercised. ‘(3) TCA does not fail to comply with subsection (2) if— (a) it is not possible for TCA to give the individual the information required to be given under subsection (2) (the required information ) within 28 days after receiving the request; and (b) TCA— (i) within 28 days after receiving the request, gives the individual an interim reply that— (A) gives the individual as much of the required information as TCA can give within the 28 days; and (B) states the reason TCA can not give the individual the rest of the required information; and (C) states an estimate of how long it will take TCA to give the individual the rest of the required information; and (ii) as soon as possible after the interim reply is given to the individual, takes reasonable steps to give the individual the rest of the required information. ‘(4) TCA must, if asked by an individual about whom TCA holds personal information, give the individual access to the personal information without undue delay or cost. ‘(5) Subsection (2), (3) or (4) does not require TCA— (a) to inform an individual that a report under section 55T or 55U exists or has been made; or (b) to give an individual access to the report. 2008 SL No. 114 Page 31

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘55ZF TCA’s obligation to keep records relating to its transactions ‘(1) TCA must keep records, in a way complying with subsections (2) to (4), relating to its transactions with the chief executive, IAP service providers or IAP auditors. ‘(2) Records kept under subsection (1) must be organised in a way that will enable them to be conveniently and properly audited. ‘(3) TCA must keep any noncompliance report received by it for at least 4 years after its receipt. ‘(4) TCA must keep any other record to which subsection (1) applies for at least 1 year after the record is made. ‘55ZG TCA’s obligation to correct errors etc. ‘(1) If asked by a participating operator or an IAP service provider about whom TCA holds personal information to make a particular change to the personal information, TCA must make the change if it is satisfied the change is appropriate to ensure the personal information is accurate, up-to-date and complete. ‘(2) If TCA is not satisfied as mentioned in subsection (1), it may refuse to comply with the request. ‘(3) If TCA refuses, under subsection (2), to comply with the request, it must— (a) give the participating operator or IAP service provider a written statement of TCA’s reasons for refusing; and (b) if asked by the participating operator or IAP service provider, attach to or include with the personal information the request or a record of the request. ‘55ZH TCA’s obligations relating to reporting tampering or malfunction ‘(1) For this section, TCA does not know or suspect an approved intelligent transport system has been tampered with or has malfunctioned only because it has— Page 32 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) accessed a report made by an approved intelligent transport system, including a report contained in a noncompliance report, of the electronic detection of apparent tampering with, or malfunctioning of, the system; or (b) analysed information generated by an approved intelligent transport system. ‘(2) If TCA knows, or has reasonable grounds to suspect, that an approved intelligent transport system fitted to an IAP vehicle has been tampered with or has malfunctioned, TCA must report the matter to the chief executive within 5 business days. ‘(3) If TCA knows, or has reasonable grounds to suspect, that an approved intelligent transport system fitted to an IAP vehicle has been tampered with, TCA must not disclose to any person other than the chief executive any of the following information— (a) that TCA has that knowledge or suspicion; (b) any information from which the person to whom the disclosure is made could reasonably infer that TCA has that knowledge or suspicion; unless the disclosure is authorised under another law. ‘(4) If TCA has made a report to the chief executive under subsection (2) of apparent tampering or suspicion of tampering, TCA must not disclose to any person other than the chief executive any of the following information— (a) that the report has been made; (b) any information from which the person to whom the disclosure is made could reasonably infer that TCA has made the report; unless the disclosure is authorised under another law. 2008 SL No. 114 Page 33

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘Division 7 Duties, powers and obligations of IAP auditors ‘55ZI What IAP audit is ‘An IAP audit is the process of doing 1 or more of the following— (a) reviewing IAP information held by an IAP service provider to decide its completeness and reliability; (b) reviewing the processes by which IAP information collected by an IAP service provider is generated, recorded, stored, displayed, analysed, transmitted and reported; (c) examining how IAP information held by an IAP service provider is used and disclosed by the IAP service provider; (d) examining an intelligent transport system before its approval as an approved intelligent transport system; (e) examining an approved intelligent transport system. ‘55ZJ IAP auditors’ duties in relation to use and disclosure of IAP information ‘(1) An IAP auditor must not use or disclose IAP information unless the IAP auditor is reasonably satisfied, having regard to the purpose for which the information is to be used or disclosed, that the information is accurate, up-to-date and complete. Maximum penalty—80 penalty units. ‘(2) An IAP auditor must not use or disclose IAP information for a purpose other than the purpose for which the information was collected by the IAP auditor, unless the use or disclosure is authorised under another law. Maximum penalty—80 penalty units. ‘(3) An IAP auditor must not disclose IAP information relating to a particular participating operator other than to— Page 34 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) the participating operator; or (b) TCA; or (c) the chief executive; or (d) if for an audit of the IAP service provider with whom the participating operator has entered into an IAP agreement, the IAP service provider; unless the disclosure is authorised under this regulation or another law. Maximum penalty—80 penalty units. ‘(4) An IAP auditor must not disclose IAP information relating to noncompliance, or tampering with or malfunctioning of an approved intelligent transport system, other than to any of the following— (a) the chief executive; (b) TCA; (c) for IAP information relating to noncompliance revealed by an approved intelligent transport system, the IAP service provider who uses the system; (d) for IAP information relating to tampering with an approved intelligent transport system, the IAP service provider who reported the tampering to the chief executive or TCA; (e) for IAP information relating to malfunctioning of an approved intelligent transport system, the IAP service provider who uses the system; unless the disclosure is authorised under another law. Maximum penalty—80 penalty units. ‘(5) If an IAP auditor uses or discloses IAP information, other than in relation to the IAP or for law enforcement purposes, the IAP auditor must make a record of the use or disclosure in a way complying with subsection (6) and containing the following information— (a) the name of the person who used or disclosed the IAP information; 2008 SL No. 114 Page 35

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (b) the date of the use or disclosure; (c) for a use of IAP information by the IAP auditor, a brief description of how the information was used; (d) for a disclosure of IAP information by the IAP auditor, the person or entity to whom the information was disclosed; (e) the provision of this regulation or the other law that authorised the use or disclosure; (f) if the use or disclosure is authorised only with a particular document, for example, a warrant, a certificate or a consent, a copy of the document. Maximum penalty—80 penalty units. ‘(6) An IAP auditor must make a record under subsection (5)— (a) within 5 business days after the relevant use or disclosure; and (b) in a form that allows the record to be readily inspected. ‘(7) An IAP auditor must keep a record made under subsection (5) for at least 7 years. Maximum penalty for subsection (7)—80 penalty units. ‘55ZK IAP auditors’ powers to collect information that will become IAP information and hold, store, use and disclose IAP information ‘(1) An IAP auditor may collect information that when collected will become IAP information, and hold, store, use and disclose IAP information, for— (a) the performance of the IAP auditor’s functions under the IAP; or (b) reporting, to TCA, noncompliance or tampering with an approved intelligent transport system by a participating operator; or (c) reporting, to TCA, tampering with an approved intelligent transport system by an IAP service provider, Page 36 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] or a failure by an IAP service provider to comply with the IAP service provider’s obligations under this part. ‘(2) An IAP auditor may use or disclose IAP information— (a) if the IAP information is personal information—with the consent of the individual that the personal information is about; or (b) as otherwise authorised by this regulation or any other law. ‘55ZL IAP auditors’ obligations in relation to collecting IAP information ‘(1) An IAP auditor may collect IAP information that is reasonably necessary to enable the IAP auditor to prepare a report about an IAP audit conducted by the IAP auditor. ‘(2) Subsection (1) does not limit section 55ZK. ‘(3) An IAP auditor must take reasonable steps to ensure that IAP information that the IAP auditor collects— (a) is necessary for, or is directly related to, the purpose for which it is collected, or a directly related purpose; and (b) is not excessive for that purpose; and (c) is accurate, up-to-date and complete. Maximum penalty—50 penalty units. ‘(4) An IAP auditor must take reasonable steps to ensure that the collection of IAP information does not intrude to an unreasonable extent on the personal privacy of any individual to whom the information relates. Maximum penalty for subsection (4)—50 penalty units. ‘55ZM IAP auditors’ obligations to keep IAP information secure and destroy or remove personal information ‘(1) An IAP auditor must take reasonable steps to protect IAP information collected by the IAP auditor against unauthorised 2008 SL No. 114 Page 37

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] access, unauthorised use, misuse, loss, modification or unauthorised disclosure. Maximum penalty—80 penalty units. ‘(2) An IAP auditor must take reasonable steps to— (a) destroy personal information no longer needed for an IAP audit conducted by the IAP auditor; or (b) remove permanently from the information anything by which an individual can be identified. Maximum penalty—80 penalty units. ‘55ZN IAP auditors’ obligation to make individuals aware of personal information held ‘(1) If asked by an individual about whom an IAP auditor holds personal information, the IAP auditor must, within 28 days after receiving the request, give the individual the following information if the IAP auditor can reasonably give the information— (a) the kinds of information the IAP auditor holds about the individual; (b) the purpose for which the information is held; (c) the persons and entities to whom the information may be disclosed; (d) that the collection of the information is authorised under this part; (e) that, under this part, the individual has rights of access to the information or to have the information changed to ensure it is accurate, up-to-date and complete; (f) how the rights mentioned in paragraph (e) can be exercised. Maximum penalty—80 penalty units. ‘(2) An IAP auditor does not commit an offence against subsection (1) if— Page 38 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] (a) it is not possible for the IAP auditor to give the individual the information required to be given under subsection (1) (the required information ) within 28 days after receiving the request; and (b) the IAP auditor— (i) within 28 days after receiving the request, gives the individual an interim reply that— (A) gives the individual as much of the required information as the IAP auditor can give within the 28 days; and (B) states the reason the IAP auditor can not give the individual the rest of the required information; and (C) states an estimate of how long it will take the IAP auditor to give the individual the rest of the required information; and (ii) as soon as possible after the interim reply is given to the individual, takes reasonable steps to give the individual the rest of the required information. ‘(3) An IAP auditor must, if asked by an individual about whom the IAP auditor holds personal information, give the individual access to the information without undue delay or cost. Maximum penalty—80 penalty units. ‘(4) Subsection (1), (2) or (3) does not require an IAP auditor— (a) to inform an individual that a report under section 55T or 55U exists or has been made; or (b) to give an individual access to the report. ‘55ZO IAP auditors’ obligation to keep records of transactions ‘(1) An IAP auditor must keep, in a way complying with subsection (2), records relating to its transactions with IAP service providers or TCA. 2008 SL No. 114 Page 39

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] Maximum penalty—80 penalty units. ‘(2) Records kept under subsection (1) must be organised in a way that will enable them to be conveniently and properly audited. ‘(3) An IAP auditor must keep each record to which subsection (1) applies for at least 7 years after the record is made. Maximum penalty for subsection (3)—80 penalty units. ‘55ZP IAP auditors’ obligation to correct errors etc. ‘(1) An IAP auditor must take reasonable steps to ensure that information that the IAP auditor collects is accurate, up-to-date and complete. Maximum penalty—50 penalty units. ‘(2) If asked by a participating operator or an IAP service provider about whom an IAP auditor holds personal information to make a particular change to the personal information, the IAP auditor must make the change if it is satisfied the change is appropriate to ensure the personal information is accurate, up-to-date and complete. Maximum penalty—50 penalty units. ‘(3) If an IAP auditor is not satisfied as mentioned in subsection (2) in relation to a request under the subsection, the IAP auditor may refuse to comply with the request. ‘(4) If, under subsection (3), an IAP auditor refuses to comply with a participating operator’s or IAP service provider’s request under subsection (2), the IAP auditor must— (a) give the participating operator or IAP service provider a written statement of the IAP auditor’s reasons for refusing; and (b) if asked by the participating operator or IAP service provider, attach to or include with the personal information the request or a record of the request. Maximum penalty for subsection (4)—50 penalty units. Page 40 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 6] ‘55ZQ IAP auditors’ obligation to report breaches by IAP service providers ‘If an IAP auditor knows of a breach by an IAP service provider of an obligation under this part, or of anything that indicates that an IAP service provider may have breached an obligation under this part, the IAP auditor must, as soon as practicable, report the matter to TCA. Maximum penalty—80 penalty units. ‘55ZR IAP auditors’ obligation to report tampering ‘If an IAP auditor knows, or has reasonable grounds to suspect, that an approved intelligent transport system has been tampered with, the IAP auditor must, immediately, report the matter to TCA. Maximum penalty—80 penalty units. ‘Division 8 Tampering with approved intelligent transport systems ‘55ZS Meaning of tampers ‘(1) A person tampers with an approved intelligent transport system if— (a) the person engages in conduct that has the result that— (i) the system is changed; or (ii) the system is installed or used in a way that is not in accordance with the conditions of its certification by TCA; or (iii) any operating software that the system uses internally is changed; and (b) the person— (i) does so with the intention of causing the system to— 2008 SL No. 114 Page 41

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 7] (A) fail to generate, record, store, display, analyse, transmit, or report IAP information; or (B) fail to generate, record, store, display, analyse, transmit, or report IAP information correctly; or (ii) is negligent or reckless as to whether, as a result of the conduct, the system may— (A) fail to generate, record, store, display, analyse, transmit, or report IAP information; or (B) fail to generate, record, store, display, analyse, transmit, or report IAP information correctly. ‘(2) For subsection (1), fail — (a) means does not perform as intended in terms of accuracy, timeliness, reliability, verifiability or any other performance parameter; and (b) includes fail permanently, fail temporarily, fail on a particular occasion, and fail in particular circumstances. ‘55ZT Tampering with approved intelligent transport system ‘A person must not tamper with an approved intelligent transport system. Maximum penalty— (a) if section 55ZS(1)(b)(i) applies—80 penalty units; or (b) if section 55ZS(1)(b)(ii) applies—50 penalty units.’. 7 Amendment of sch 11 (Dictionary) Schedule 11— insert— ‘ IAP means intelligent access program. Page 42 2008 SL No. 114

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 7] IAP agreement means an agreement between the operator of a vehicle and an IAP service provider under which the IAP service provider agrees to monitor the vehicle’s compliance with IAP conditions. IAP audit see section 55ZI. IAP auditor see section 61D(4) of the Act. IAP conditions see section 55A. IAP information means information, including personal information, that has been generated or collected for any purpose relating to the IAP. IAP service provider see section 61D(4) of the Act. IAP vehicle means a vehicle that is subject to IAP conditions, is equipped for monitoring under the IAP, and is covered by an IAP agreement. IAP website means the website on the internet maintained by TCA for use for the IAP. Editor’s note — At the commencement of this definition, the IAP website was at < law enforcement purposes means the purposes of investigating or prosecuting an offence, whether summary or indictable, against a transport Act. malfunction , of an approved intelligent transport system, see section 55F. noncompliance means a contravention by an IAP vehicle of the IAP conditions. noncompliance report see section 55G. participating operator means an operator of a vehicle who has entered into an IAP agreement, and operates at least 1 IAP vehicle. personal information means information or an opinion, including information or an opinion forming part of a database, whether true or not, and whether recorded in a material form or not, about an individual whose identity is 2008 SL No. 114 Page 43

Transport Operations (Road Use Management—Mass, Dimensions and Loading) Amendment Regulation (No. 1) 2008 [s 7] apparent, or can reasonably be found out, from the information or opinion. tampers , with an approved intelligent transport system, see section 55ZS.’. ENDNOTES 1 Made by the Governor in Council on 8 May 2008. 2 Notified in the gazette on 9 May 2008. 3 Laid before the Legislative Assembly on . . . 4 The administering agency is the Department of Transport. © State of Queensland 2008 Page 44 2008 SL No. 114