Cyber Security Act 2024

The Board must prepare a draft report (a draft review report) on a review being conducted under section 46 by a review panel.

The draft review report must set out:

the preliminary findings of the review; and

a summary of the information and material on which those preliminary findings are based; and

any recommendations the Board proposes to make; and

if the Board proposes to make recommendations—the reasons for those proposed recommendations; and

if the terms of reference for the review require particular information to be included in the draft review report—that information; and

information (if any) that is prescribed by the rules; and

such other information that the Board thinks fit to include in the draft review report.

The Board must give the draft review report to the Minister.

The Board may give the draft review report, or an extract of the draft review report, to any other Commonwealth body or a State body or entity:

if the Board considers it appropriate to give the body or entity an opportunity to make submissions on the draft review report or the extract; or

for the purposes of determining whether information proposed to be included in the final review report is sensitive review information.

The disclosure of sensitive review information may be prohibited under another Act (for example, the Privacy Act 1988). This section does not authorise disclosure if prohibited under that Act: see subsection (7) of this section.

Sensitive review information must be redacted from a final review report that is to be published by the Board: see section 53.

If the Board gives a draft review report to the Minister under subsection (3), or a Commonwealth body, State body or entity under subsection (4), the Board must specify a reasonable period within which submissions may be made to the Board on the draft review report.

Submissions must be given in the manner and form (if any) prescribed by the rules.

However, this section does not authorise the Board to record, use or disclose the information to the extent that it is prohibited or restricted by or under the Privacy Act 1988 or any other Act.