(1) A person to whom a privacy principle applies must not, without lawful authority, contravene the privacy principle.
(2) A person is taken not to have lawful authority to contravene a privacy principle unless the person proves that, in the circumstances, compliance with the privacy principle would have contravened—
(a) a law of the Territory; or
(b) a law of the Commonwealth; or
(c) an order of a court of competent jurisdiction.