Before thinking about consequences, it would be appropriate to determine whether disclosure was authorized and legitimate. As I said earlier, there are exceptions to the non-disclosure requirement. Consequently, the first step would be to determine whether any exceptions applied. If there were none, this would constitute a breach of the Privacy Act.
On February 15th, 2011. See this statement in context.