Unlawful acts by third parties in connection with account number

106. (1) A person who knowingly or recklessly, without the consent of the responsible party—
(a) obtains or discloses an account number of a data subject; or
(b) procures the disclosure of an account number of a data subject to another person, is, subject to subsection (2), guilty of an offence. 

(2) Whenever a person is charged with an offence under subsection (1), it is a valid defence to such a charge to contend that—
(a) the obtaining, disclosure or procuring of the account number was—
(i) necessary for the purpose of the prevention, detection, investigation or proof of an offence; or
(ii) required or authorised in terms of the law or in terms of a court order;
(b) he or she acted in the reasonable belief that he or she was legally entitled to obtain or disclose the account number or, as the case may be, to procure the disclosure of the account number to the other person;
(c) he or she acted in the reasonable belief that he or she would have had the consent of the responsible party if the responsible party had known of the obtaining, disclosing or procuring and the circumstances of it; or
(d) in the particular circumstances the obtaining, disclosing or procuring was in the public interest.

(3) A person who sells an account number which he or she has obtained in contravention of subsection (1), is guilty of an offence.

(4) A person who offers to sell the account number of a data subject which that person—
(a) has obtained; or
(b) subsequently obtained, in contravention of subsection (1), is guilty of an offence.

(5) For the purposes of subsection (4), an advertisement indicating that an account number of a data subject is or may be for sale is an offer to sell the information.