Cyber Security Act 2024 · Version 2024-11-29

32 Admissibility of information in ransomware payment report against reporting business entity

Reading presentation · Verification limits and dated status · No live currency check

Part 3—Ransomware reporting obligations

(1) This section applies to information that:
(a) has been provided in a ransomware payment report by a reporting business entity; and
(b) has been obtained by a Commonwealth body or State body under section 27, subsection 29(1) or section 30; and
(c) is held by the Commonwealth body or State body.

Note: This section does not apply to information held by the Commonwealth body or State body to the extent that it has been otherwise obtained.

(2) That information is not admissible in evidence against the reporting business entity in any of the following proceedings:
(a) criminal proceedings for an offence against a Commonwealth, State or Territory law, other than:
- (i) proceedings for an offence against section 137.1 or 137.2 of the Criminal Code (which deal with false or misleading information or documents) that relates to this Act; or
- (ii) proceedings for an offence against section 149.1 of the Criminal Code (which deals with obstruction of Commonwealth public officials) that relates to this Act;
(b) civil proceedings for a contravention of a civil penalty provision of a Commonwealth, State or Territory law, other than a civil penalty provision of this Part;
(c) proceedings for a breach of any other Commonwealth, State or Territory law (including the common law);
(d) proceedings before a tribunal of the Commonwealth, a State or a Territory.
(3) However, this section does not apply to the following:
(a) the proceedings of a coronial inquiry or a Royal Commission in Australia;
(b) proceedings in a federal court exercising original jurisdiction in which a writ of mandamus or prohibition or an injunction is sought against an officer or officers of the Commonwealth.

Note: For federal court, see section 2B of the Acts Interpretation Act 1901.

(4) This section does not limit or affect any right, privilege or immunity that the reporting business entity has, apart from this section, as a defendant in any proceedings.