Commonwealth Consolidated Acts

SECURITY OF CRITICAL INFRASTRUCTURE ACT 2018 - SECT 30DJ

Scope

  (1)   This section applies if:

  (a)   a computer:

  (i)   is needed to operate a system of national significance; or

  (ii)   is a system of national significance; and

  (b)   the Secretary believes on reasonable grounds that a relevant entity for the system of national significance would not be technically capable of preparing reports under section   30DB or 30DC consisting of information that:

  (i)   relates to the operation of the computer; and

  (ii)   may assist with determining whether a power under this Act should be exercised in relation to the system of national significance; and

  (iii)   is not personal information (within the meaning of the Privacy Act 1988 ).

Requirement

  (2)   The Secretary may, by written notice given to the entity, require the entity to:

  (a)   both:

  (i)   install a specified computer program on the computer; and

  (ii)   do so within the period specified in the notice; and

  (b)   maintain the computer program installed in accordance with paragraph   (a); and

  (c)   take all reasonable steps to ensure that the computer is continuously supplied with an internet carriage service that enables the computer program to function.

  (3)   A notice under subsection   (2) is to be known as a system information software notice .

  (4)   In deciding whether to give a system information software notice to the entity, the Secretary must have regard to:

  (a)   the costs that are likely to be incurred by the entity in complying with the notice; and

  (b)   the reasonableness and proportionality of the requirements in the notice; and

  (c)   such other matters (if any) as the Secretary considers relevant.

  (5)   A computer program may only be specified in a system information software notice if the purpose of the computer program is to:

  (a)   collect and record information that:

  (i)   relates to the operation of the computer; and

  (ii)   may assist with determining whether a power under this Act should be exercised in relation to the system of national significance; and

  (iii)   is not personal information (within the meaning of the Privacy Act 1988 ); and

  (b)   cause the information to be transmitted electronically to ASD.

Matters to be set out in notice

  (6)   A system information software notice must set out the effect of section   30DM.

Other powers not limited

  (7)   This section does not, by implication, limit a power conferred by another provision of this Act.