60Periodic report

60 Periodic report

(1) The Secretary must give the Minister, for presentation to the Parliament, a report on the operation of this Act for a financial year. (2) Without limiting subsection (1), the report must deal with: (a) the number of notifications that were made during the financial year to the Secretary under Division 3 of Part 2 (obligation to give information and notify of events); and (aa) the number of notifications that were made during the financial year to the Secretary under Division 3 of Part 2D (responsible entity’s notification obligations impacting their security obligations); and (ab) any directions given during the financial year by the Minister under section 30EF (Minister’s direction if use or supply of carriage services prejudicial to security); and (b) any directions given during the financial year by the Minister under section 32 (direction if risk of act or omission that would be prejudicial to security); and (c) the use during the financial year of the Secretary’s powers under Division 2 of Part 4 (Secretary’s power to obtain information or documents); and (d) any action taken during the financial year against an entity under the Regulatory Powers Act as a result of Part 5 (enforcement) of this Act; and (e) the number of declarations of assets as critical infrastructure assets that were made during the financial year by the Minister under section 51; and (f) the number of annual reports given under section 30AG during the financial year; and (g) the number of annual reports given under section 30AG during the financial year that included a statement to the effect that a critical infrastructure risk management program was up to date at the end of the financial year; and (gaa) the number of directions given to entities under section 30AI during the financial year; and (ga) the number of annual reports given under section 30AQ during the financial year; and (h) the number of cyber security incidents reported during the financial year under section 30BC; and (i) the number of cyber security incidents reported during the financial year under 30BD; and (j) the number of notices given to entities under section 30CB during the financial year; and (k) the number of notices given to entities under section 30CM during the financial year; and (l) the number of notices given to entities under section 30CU during the financial year; and (m) the number of notices given to entities under Division 5 of Part 2C during the financial year; and (n) the number of Ministerial authorisations given under section 35AB during the financial year; and (o) the number of Ministerial authorisations given under paragraph 35AB(2)(a) or (b) during the financial year; and (p) the number of Ministerial authorisations given under paragraph 35AB(2)(c) or (d) during the financial year; and (q) the number of Ministerial authorisations given under paragraph 35AB(2)(e) or (f) during the financial year; and (r) the number of declarations of assets as systems of national significance that were made under section 52B during the financial year. (3) A report under subsection (1) must not include personal information (within the meaning of the Privacy Act 1988).