Schedule 1 Part 3 rewrites the emergency declaration regime: a declaration must specify the kinds of personal information, the entities that may collect, use or disclose it, the recipients (which may include State or Territory authorities but not media organisations, the ABC or SBS) and permitted purposes directly related to the Commonwealth's response to the emergency or disaster, may attach conditions, and ceases after 12 months at most. While one is in force an entity may collect, use or disclose personal information about an individual it reasonably believes may be involved, for a specified purpose, of a specified kind, by and to specified entities, with conditions met. A person who receives information because of Part VIA and then discloses it, not being a responsible person for the individual, commits an offence unless an exception applies, which now include disclosures for a State's constitutional functions and for legal advice on the Part.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.