36 Voluntary provision of information in relation to other incidents or cyber security incidents

• (1) This section applies if:
• (a) an incident has occurred, is occurring or is imminent; and
• (b) an entity (the impacted entity) provides information to the National Cyber Security Coordinator in relation to the incident; and
• (c) it is unclear at the time the information is provided whether the incident is a cyber security incident or a significant cyber security incident.
• (2) The National Cyber Security Coordinator may collect and use the information for the purposes of determining whether the incident is a cyber security incident or a significant cyber security incident.

Note: This subsection constitutes an authorisation for the National Cyber Security Coordinator to collect the information (including sensitive information) for the purposes of the Privacy Act 1988.