Cyber Security Act 2024 (Australia) 29: s 29 Designated Commonwealth body may use a ransomware payment report only for permitted purposes and not to enforce other laws against the reporter

The designated Commonwealth body may record, use or disclose a ransomware payment report only to assist the reporting entity and those acting for it to respond to, mitigate or resolve the incident, to perform its functions under Part 3 or Part 6, for false-information or obstruction proceedings under the Criminal Code relating to the Act, for the incident-response functions of Commonwealth and State bodies and the Coordinator, to inform Ministers and for intelligence agency functions; it must not record, use or disclose it to investigate or enforce any contravention of a law by the reporting entity other than Part 3 itself or a criminal law; the Privacy Act is not displaced; information given under SOCI Part 2B, the Telecommunications Act or a prescribed law, or already lawfully public, is outside the restriction.