Any entity that receives a qualifying disclosure must take reasonable steps to preserve the anonymity of the discloser and anyone named in a request for anonymity; must not disclose the discloser's identity or information likely to identify them, obtained because of the disclosure, except to the Commission, the Department, the Inspector-General, police, a lawyer for advice on this Part, a court or Royal Commission, with consent, to prevent a serious threat, where the discloser elected complaint handling, or where already lawfully public (30 penalty units), though non-identity information reasonably necessary to deal with the matter may be shared with steps to reduce identification risk; and must not cause or threaten detriment to anyone because of a belief or suspicion that a disclosure was or may be made (500 penalty units each), reasonable administrative protective action excepted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.