The Coordinator may record, use or disclose information provided under s 35(2) only to assist the impacted entity and those acting for it to respond to, mitigate or resolve the incident, or for a permitted cyber security purpose under s 10, and must not record, use or disclose it to investigate or enforce any contravention by the impacted entity of a law other than Part 4 or a criminal law; the Privacy Act is not displaced, State bodies receive it only with ministerial consent, and information given to comply with Part 3, SOCI Part 2B, the Telecommunications Act or a prescribed law, given voluntarily outside Part 4, or already lawfully public is outside the restriction. For information about an incident that turns out not to be a cyber security incident or not significant, the Coordinator may use it only to direct the entity to other services, to coordinate a whole-of-government response where necessary and to inform Ministers (s 39).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.