Document ID: chunk:federal_register_of_legislation:C2024C00797:section:41bc:p2
Version: federal_register_of_legislation:C2024C00797
Segment Type: section
Provision Reference: s 41BC (pt 2/3)
Character Range: 144964–147811

Territory law that:
 (a) is a contravention by the impacted entity that:
 (i) originally voluntarily provided the information to ASD as referred to in paragraph 41BA(2)(a); or
 (ii) consented to the information being acquired or prepared by ASD as referred to in paragraph 41BA(2)(b); or
 (iii) originally voluntarily provided the information to the National Cyber Security Coordinator under subsection 35(2), or as referred to in subsection 39(1), of the Cyber Security Act 2024; and
 (b) is not a contravention by the impacted entity of:
 (i) this Division; or
 (ii) a law that imposes a penalty or sanction for a criminal offence.
Note: See also section 41BF in relation to admissibility of the information in proceedings.

Interaction with this Act
 (4) Subsection (2) does not authorise the Commonwealth body, State body or entity to use or communicate the information to the extent that it is prohibited or restricted by or under this Act.

Information not covered by the prohibitions in this section
 (5) Subsection (2) does not prohibit:
 (a) use or communication of the limited cyber security information, by the Commonwealth body, State body or entity, with the consent of the impacted entity that:
 (i) originally voluntarily provided the limited cyber security information to ASD as referred to in paragraph 41BA(2)(a); or
 (ii) consented to the limited cyber security information being acquired or prepared by ASD as referred to in paragraph 41BA(2)(b); or
 (iii) originally voluntarily provided the limited cyber security information to the National Cyber Security Coordinator under subsection 35(2), or as referred to in subsection 39(1), of the Cyber Security Act 2024; or
 (b) use or communication of information for the purposes of carrying out a State's constitutional functions, powers or duties.

Civil penalty for contravention of this section
 (6) An entity is liable to a civil penalty if:
 (a) the entity contravenes subsection (2); and
 (b) the entity is not a Commonwealth officer (within the meaning of Part 5.6 of the Criminal Code); and
 (c) any of the following applies:
 (i) the information is sensitive information (within the meaning of the Privacy Act 1988) about an individual and the individual has not consented to the use or communication of the information;
 (ii) the information is confidential or commercially sensitive;
 (iii) the use or communication of the information would, or could reasonably be expected to cause, damage to the security, defence or international relations of the Commonwealth.
Note 1: See the Criminal Code for offences for Commonwealth officers.
Note 2: This section does not make the Crown (other than an authority of the Crown) liable to a civil penalty, see section 41BD.
Note 3: For the application of provisions of the Regulatory Powers (Standard Provisions) Act 2014 to this