Any other entity, Commonwealth body (other than ASD, which is governed by Division 1A of Part 6 of the Intelligence Services Act 2001) or State body that obtains information provided to the Coordinator under s 35 or s 39 may record, use or disclose it only to assist the impacted entity or for a permitted cyber security purpose, never to investigate or enforce a contravention by the impacted entity of a law other than Part 4 or a criminal law, subject to the Privacy Act and with the same carve-outs for exempt information, an individual's own personal information, the impacted entity's own information with consent and a State's constitutional functions; an entity other than a Commonwealth officer contravening the limit where the information is sensitive without consent, confidential or commercially sensitive, or damaging to security, defence or international relations is liable to 60 penalty units.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.