Division 3—Protection of information relating to reviews

Permitted use and disclosure

• (1) The Board may make a record of, use or disclose information provided by an entity, Commonwealth body or State body under section 48, 49 or 51 but only:
• (a) for the purposes of one or more of the following:
  • (i) performing functions or exercising powers under this Part or Part 6 as it applies to this Part;
  • (ii) proceedings under, or arising out of, section 137.1 or 137.2 of the Criminal Code (false and misleading information and documents) that relate to this Act;
  • (iii) proceedings for an offence against section 149.1 of the Criminal Code (which deals with obstruction of Commonwealth public officials) that relates to this Act;
  • (iv) the performance of the functions of a Commonwealth body relating to responding to, mitigating or resolving a cyber security incident;
  • (v) the performance of the functions of a State body relating to responding to, mitigating or resolving a cyber security incident;
  • (vi) informing and advising the Minister, and other Ministers of the Commonwealth, about a cyber security incident;
  • (vii) the performance of the functions of an intelligence agency; or
• (b) as otherwise authorised by a provision of this Part.

Note: Certain information must not be disclosed to a State body under Parts of this Act unless a Minister of the State or Territory has consented to those Parts applying to the State body: see section 11.

Restriction on use and disclosure for civil or regulatory action

• (2) However, the Board must not make a record of, use or disclose the information for the purposes of investigating or enforcing, or assisting in the investigation or enforcement of, any contravention by the entity or body of a Commonwealth, State or Territory law other than:
• (a) a contravention by the entity or body of this Part; or
• (b) a contravention by the entity or body of a law that imposes a penalty or sanction for a criminal offence.

Note: See also section 58 in relation to admissibility of the information in proceedings.

Interaction with the Privacy Act 1988

• (3) Subsection (1) does not authorise the Board to record, use or disclose the information to the extent that it is prohibited or restricted by or under the Privacy Act 1988.

Information not covered by the prohibitions in this section

• (4) Subsection (1) does not prohibit the recording, use or disclosure of information that has already been lawfully made available to the public.

• (1) This section applies to information that:
• (a) has been provided to the Board under section 48, 49 or 51; and
• (b) has been obtained under section 54 or 55, or this section, by an entity, a Commonwealth body or a State body; and
• (c) is held by the entity, Commonwealth body or State body.

Note: This section does not apply to the information to the extent that it has been otherwise obtained by the entity, Commonwealth body or State body.

Permitted use and disclosure

• (2) The entity, Commonwealth body or State body may make a record of, use or disclose the information but only:
• (a) for the purposes of one or more of the following:
  • (i) performing functions or exercising powers, or assisting in the performance of functions or the exercise of powers, under this Part or Part 6 as it applies to this Part;
  • (ii) proceedings under, or arising out of, section 137.1 or 137.2 of the Criminal Code (false and misleading information and documents) that relate to this Act;
  • (iii) proceedings for an offence against section 149.1 of the Criminal Code (which deals with obstruction of Commonwealth public officials) that relates to this Act;
  • (iv) the performance of the functions of a Commonwealth body relating to responding to, mitigating or resolving a cyber security incident;
  • (v) the performance of the functions of a State body relating to responding to, mitigating or resolving a cyber security incident;
  • (vi) informing and advising the Minister, and other Ministers of the Commonwealth, about a cyber security incident;
  • (vii) the performance of the functions of an intelligence agency; or
• (b) as otherwise authorised by a provision of this Part.

Restriction on use and disclosure for civil or regulatory action

• (3) However, the entity, Commonwealth body or State body must not make a record of, use or disclose the information for the purposes of investigating or enforcing, or assisting in the investigation or enforcement of, any contravention, by the entity or body that originally provided the information under section 48, 49 or 51, of a Commonwealth, State or Territory law other than:
• (a) a contravention by the entity or body of this Part; or
• (b) a contravention by the entity or body of a law that imposes a penalty or sanction for a criminal offence.

Note: See also section 58 in relation to admissibility of the information in proceedings.

Interaction with the Privacy Act 1988

• (4) Subsection (2) does not authorise the entity, Commonwealth body or State body to record, use or disclose the information to the extent that it is prohibited or restricted by or under the Privacy Act 1988.

Information not covered by the prohibitions in this section

• (5) Subsection (2) does not prohibit:
• (a) recording, use or disclosure of information that has already been lawfully made available to the public (for example, in the publication of the final review report); or
• (b) if the entity is an individual—recording, use or disclosure of personal information about the individual; or
• (c) if the entity or body is the entity or body that originally provided the information under section 48, 49 or 51—the entity’s or body’s own information; or
• (d) recording, use or disclosure of that entity’s or body’s own information, with the consent of that entity or body, by another entity, a Commonwealth body or a State body; or
• (e) recording, use or disclosure of information for the purposes of carrying out a State’s constitutional functions, powers or duties.

Civil penalty for contravention of this section

• (6) An entity is liable to a civil penalty if:
• (a) the entity contravenes subsection (2); and
• (b) the entity is not a Commonwealth officer; and
• (c) any of the following applies:
  • (i) the information is sensitive information about an individual and the individual has not consented to the record, use or disclosure of the information;
  • (ii) the information is confidential or commercially sensitive;
  • (iii) the record, use or disclosure of the information would, or could reasonably be expected to, cause damage to the security, defence or international relations of the Commonwealth.

Note 1: See the Criminal Code for offences for Commonwealth officers.

Note 2: This Act does not make the Crown (other than an authority of the Crown) liable to a civil penalty.

Civil penalty: 60 penalty units.

• (1) The fact that an entity provided information to the Board under section 48, 49 or 51 does not otherwise affect a claim of legal professional privilege that anyone may make in relation to that information in any proceedings:
• (a) under any Commonwealth, State or Territory law (including the common law); or
• (b) before a tribunal of the Commonwealth, a State or a Territory.
• (2) Despite subsection (1), this section does not apply to the following:
• (a) the proceedings of a coronial inquiry or a Royal Commission in Australia;
• (b) proceedings in a federal court exercising original jurisdiction in which a writ of mandamus or prohibition or an injunction is sought against an officer or officers of the Commonwealth.

Note: For federal court, see section 2B of the Acts Interpretation Act 1901.

• (3) This section does not limit or affect any right, privilege or immunity that the entity has, apart from this section, as a defendant in any proceedings.

• (1) This section applies to information that:
• (a) has been provided by an entity to the Board under section 48, 49 or 51; and
• (b) has been obtained under section 48, 49, 51, 54, 55 or 56 by a Commonwealth body or a State body; and
• (c) is held by the Commonwealth body or State body.

Note: This section does not apply to information held by the Commonwealth body or State body to the extent that it has been otherwise obtained.

• (2) The information is not admissible in evidence against the entity in any of the following proceedings:
• (a) criminal proceedings for an offence under a Commonwealth law, other than:
  • (i) proceedings for an offence against section 137.1 or 137.2 of the Criminal Code (which deal with false or misleading information or documents) that relates to this Act; or
  • (ii) proceedings for an offence against section 149.1 of the Criminal Code (which deals with obstruction of Commonwealth public officials) that relates to this Act;
• (b) civil proceedings for a contravention of a civil penalty provision of a Commonwealth law, other than a civil penalty provision of this Part;
• (c) proceedings for a breach of any other Commonwealth, State or Territory law (including the common law);
• (d) proceedings before a tribunal of the Commonwealth, a State or a Territory.
• (4) This section does not apply to the following:
• (a) the proceedings of a coronial inquiry or a Royal Commission in Australia;
• (b) proceedings in a federal court exercising original jurisdiction in which a writ of mandamus or prohibition or an injunction is sought against an officer or officers of the Commonwealth.

Note: For federal court, see section 2B of the Acts Interpretation Act 1901.

• (5) This section does not limit or affect any right, privilege or immunity that the entity has, apart from this section, as a defendant in any proceedings.

• (1) An entity is liable to a civil penalty if:
• (a) the entity receives a draft review report under section 51; and
• (b) the entity makes a record of, discloses or otherwise uses any information in the draft review report.

Civil penalty: 60 penalty units.

• (2) Subsection (1) does not apply if the making of the record, disclosure or use is:
• (a) for the purpose of preparing a submission to the Board in accordance with section 51; or
• (b) if the entity is the entity that originally provided the information under section 48 or 49—of the entity’s own information; or
• (c) with the consent of the Chair of the Board; or
• (d) after the information has already been lawfully made available to the public (for example, in the publication of the final review report);
• (e) for the purposes of carrying out a State’s constitutional functions, powers or duties.
• (3) Despite section 96 of the Regulatory Powers Act, in proceedings for a civil penalty order against an entity for a contravention of subsection (1), the entity does not bear an evidential burden in relation to the matters in subsection (2).

Note: This Act does not make the Crown (other than an authority of the Crown) liable to a civil penalty.