Part 5—Cyber Incident Review Board
Read this container onlyDivision 3—Protection of information relating to reviews
Read this container only59 Disclosure of draft review reports prohibited
- (1) An entity is liable to a civil penalty if:
- (a) the entity receives a draft review report under section 51; and
- (b) the entity makes a record of, discloses or otherwise uses any information in the draft review report.
Civil penalty: 60 penalty units.
- (2) Subsection (1) does not apply if the making of the record, disclosure or use is:
- (a) for the purpose of preparing a submission to the Board in accordance with section 51; or
- (b) if the entity is the entity that originally provided the information under section 48 or 49—of the entity’s own information; or
- (c) with the consent of the Chair of the Board; or
- (d) after the information has already been lawfully made available to the public (for example, in the publication of the final review report);
- (e) for the purposes of carrying out a State’s constitutional functions, powers or duties.
- (3) Despite section 96 of the Regulatory Powers Act, in proceedings for a civil penalty order against an entity for a contravention of subsection (1), the entity does not bear an evidential burden in relation to the matters in subsection (2).
Note: This Act does not make the Crown (other than an authority of the Crown) liable to a civil penalty.