Document ID: chunk:federal_register_of_legislation:C2025C00045:section:35ab:p3
Version: federal_register_of_legislation:C2025C00045
Segment Type: section
Provision Reference: s 35AB (pt 3/4)
Character Range: 223785–226589

the subject of a request under section 35AX; or
 (b) requires the specified entity to take offensive cyber action against a person who is directly or indirectly responsible for the incident.
 (9A) Without limiting paragraph (2)(c) or (d), a direction referred to in that paragraph may require a specified entity to disclose specified personal information (within the meaning of the Privacy Act 1988) held by the entity to another specified entity for a specified purpose.
 (9B) However, the Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d), to the extent that it authorises the giving of a direction covered by subsection (9A), unless the Minister has obtained the agreement of the Minister administering the Privacy Act 1988.

Intervention requests
 (10) The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) that relates to the incident and an asset unless the Minister is satisfied that:
 (aa) the incident is a cyber security incident; and
 (a) giving a Ministerial authorisation under paragraph (2)(c) or (d) would not amount to a practical and effective response to the incident; and
 (b) if there is only one relevant entity for the asset—the relevant entity is unwilling or unable to take all reasonable steps to respond to the incident; and
 (c) if there are 2 or more relevant entities for the asset—those entities, when considered together, are unwilling or unable to take all reasonable steps to respond to the incident; and
 (d) the specified request is reasonably necessary for the purposes of responding to the incident; and
 (e) the specified request is a proportionate response to the incident; and
 (f) compliance with the specified request is technically feasible; and
 (g) each of the acts or things specified in the specified request is an act or thing of a kind covered by section 35AC.
Note: Section 12P provides examples of responding to a cyber security incident.
 (11) In determining whether the specified request is a proportionate response to the incident, the Minister must have regard to:
 (a) the impact of compliance with the specified request on the functioning of the asset; and
 (b) the consequences of acts or things that would be done in compliance with the specified request; and
 (c) such other matters (if any) as the Minister considers relevant.
 (12) The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) if compliance with the specified request would involve the authorised agency taking offensive cyber action against a person who is directly or indirectly responsible for the incident.
 (13) The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) unless the Minister has obtained the agreement of:
 (a) the Prime Minister; and
 (b) the