22. (1) A person shall not access the National Register of Individual Health Identifiers except pursuant to, and in accordance with, a provision of this Act or another enactment.

(2) A person shall not process an individual’s individual health identifier (not being the individual health identifier of that person) for a purpose other than a relevant purpose.

(3) A person who knowingly contravenes subsection (1) or (2) shall be guilty of an offence and shall be liable—

(a) on summary conviction, to a class B fine, or

(b) on conviction on indictment, to a fine not exceeding €100,000.