56Limitations on secondary use and disclosure

56  Limitations on secondary use and disclosure

 (a) has been provided to the Board under section 48, 49 or 51; and

 (b) has been obtained under section 54 or 55, or this section, by an entity, a Commonwealth body or a State body; and

 (c) is held by the entity, Commonwealth body or State body.

Note: This section does not apply to the information to the extent that it has been otherwise obtained by the entity, Commonwealth body or State body.

 (2) The entity, Commonwealth body or State body may make a record of, use or disclose the information but only:

 (a) for the purposes of one or more of the following:

 (i) performing functions or exercising powers, or assisting in the performance of functions or the exercise of powers, under this Part or Part 6 as it applies to this Part;

 (ii) proceedings under, or arising out of, section 137.1 or 137.2 of the Criminal Code (false and misleading information and documents) that relate to this Act;

 (iii) proceedings for an offence against section 149.1 of the Criminal Code (which deals with obstruction of Commonwealth public officials) that relates to this Act;

 (iv) the performance of the functions of a Commonwealth body relating to responding to, mitigating or resolving a cyber security incident;

 (v) the performance of the functions of a State body relating to responding to, mitigating or resolving a cyber security incident;

 (vi) informing and advising the Minister, and other Ministers of the Commonwealth, about a cyber security incident;

 (vii) the performance of the functions of an intelligence agency; or

 (b) as otherwise authorised by a provision of this Part.

 (3) However, the entity, Commonwealth body or State body must not make a record of, use or disclose the information for the purposes of investigating or enforcing, or assisting in the investigation or enforcement of, any contravention, by the entity or body that originally provided the information under section 48, 49 or 51, of a Commonwealth, State or Territory law other than:

 (a) a contravention by the entity or body of this Part; or

 (b) a contravention by the entity or body of a law that imposes a penalty or sanction for a criminal offence.

Note: See also section 58 in relation to admissibility of the information in proceedings.

 (4) Subsection (2) does not authorise the entity, Commonwealth body or State body to record, use or disclose the information to the extent that it is prohibited or restricted by or under the Privacy Act 1988.

 (a) recording, use or disclosure of information that has already been lawfully made available to the public (for example, in the publication of the final review report); or