Skip to content
Legislation
Skip to legislation

Cyber Security Act 2024 · Version 2024-11-29

59 Disclosure of draft review reports prohibited

Register source version C2024A00098 · Source observation:

Reading presentation · Verification limits and dated status · No live currency check

Part 5—Cyber Incident Review Board

Read this container only

Division 3—Protection of information relating to reviews

Read this container only

59 Disclosure of draft review reports prohibited

  • (1) An entity is liable to a civil penalty if:
  • (a) the entity receives a draft review report under section 51; and
  • (b) the entity makes a record of, discloses or otherwise uses any information in the draft review report.

Civil penalty: 60 penalty units.

  • (2) Subsection (1) does not apply if the making of the record, disclosure or use is:
  • (a) for the purpose of preparing a submission to the Board in accordance with section 51; or
  • (b) if the entity is the entity that originally provided the information under section 48 or 49—of the entity’s own information; or
  • (c) with the consent of the Chair of the Board; or
  • (d) after the information has already been lawfully made available to the public (for example, in the publication of the final review report);
  • (e) for the purposes of carrying out a State’s constitutional functions, powers or duties.
  • (3) Despite section 96 of the Regulatory Powers Act, in proceedings for a civil penalty order against an entity for a contravention of subsection (1), the entity does not bear an evidential burden in relation to the matters in subsection (2).

Note: This Act does not make the Crown (other than an authority of the Crown) liable to a civil penalty.