Cyber Security Act 2024 (Australia) 30: s 30 Secondary recipients of report information: permitted purposes only, civil penalty of 60 penalty units

Any other entity, Commonwealth body or State body that obtains ransomware payment report information under s 29 or s 30 may record, use or disclose it only for the same permitted purposes and never to investigate or enforce a contravention by the reporting entity of a law other than Part 3 or a criminal law, subject to the Privacy Act; the restriction does not cover information already exempt under s 29(4), an individual's own personal information, the reporting entity's own information used with its consent, or a State's constitutional functions; an entity other than a Commonwealth officer contravening the limit where the information is sensitive information without consent, confidential or commercially sensitive, or damaging to security, defence or international relations is liable to a civil penalty of 60 penalty units.