A relevant entity (other than the Commonwealth) for a critical infrastructure asset may make a record of, use or disclose protected information if the entity makes the record, or uses or discloses the information:
(a) for a purpose relating to the continued operation of the critical infrastructure asset; or
(b) to mitigate a risk to the availability, integrity, reliability or security of the critical infrastructure asset.
Note: This section is an authorisation for the purposes of other laws, including the Australian Privacy Principles.