40Limitations on secondary use and disclosure

40  Limitations on secondary use and disclosure

 (a) has been provided by, or on behalf of, an entity (the impacted entity) under subsection 35(2) or as referred to in subsection 39(1); and

 (b) has been obtained by another entity, a Commonwealth body (other than ASD) or a State body under subsection 38(1) or 39(2) or this section; and

 (c) is held by the other entity, Commonwealth body or State body.

Note 1: This section does not apply to the information to the extent that it has been otherwise obtained by the other entity, Commonwealth body or State body.

Note 2: For ASD, see Division 1A of Part 6 of the Intelligence Services Act 2001.

 (2) The other entity, Commonwealth body or State body may make a record of, use or disclose the information but only for the purposes of one or more of the following:

 (a) assisting the impacted entity, and other entities acting on behalf of the impacted entity, to respond to, mitigate or resolve the cyber security incident;

 (b) a permitted cyber security purpose for a cyber security incident.

Note: For permitted cyber security purpose for a cyber security incident: see section 10.

 (3) However, the other entity, Commonwealth body or State body must not make a record of, use or disclose the information for the purposes of investigating or enforcing, or assisting in the investigation or enforcement of, any contravention by the impacted entity of a Commonwealth, State or Territory law other than:

 (4) Subsection (2) does not authorise the other entity, Commonwealth body or State body to record, use or disclose the information to the extent that it is prohibited or restricted by or under the Privacy Act 1988.

 (a) recording, use or disclosure of information referred to in subsection 38(4) or 39(5); or

 (b) if the other entity is an individual—recording, use or disclosure of personal information about the individual; or

 (c) recording, use or disclosure of the impacted entity’s own information, with the consent of the impacted entity, by another entity, a Commonwealth body or a State body; or

 (d) recording, use or disclosure for the purposes of carrying out a State’s constitutional functions, powers or duties.

 (i) the information is sensitive information about an individual and the individual has not consented to the record, use or disclosure of the information;

 (iii) the record, use or disclosure of the information would, or could reasonably be expected to, cause damage to the security, defence or international relations of the Commonwealth.