60  Periodic report

• (1)

  The Secretary must give the Minister, for presentation to the Parliament, a report on the operation of this Act for a financial year.

• (2)

  Without limiting subsection (1), the report must deal with:

  • (a)

    the number of notifications that were made during the financial year to the Secretary under Division 3 of Part 2 (obligation to give information and notify of events); and

  • (aa)

    the number of notifications that were made during the financial year to the Secretary under Division 3 of Part 2D (responsible entity’s notification obligations impacting their security obligations); and

  • (ab)

    any directions given during the financial year by the Minister under section 30EF (Minister’s direction if use or supply of carriage services prejudicial to security); and

  • (b)

    any directions given during the financial year by the Minister under section 32 (direction if risk of act or omission that would be prejudicial to security); and

  • (c)

    the use during the financial year of the Secretary’s powers under Division 2 of Part 4 (Secretary’s power to obtain information or documents); and

  • (d)

    any action taken during the financial year against an entity under the Regulatory Powers Act as a result of Part 5 (enforcement) of this Act; and

  • (e)

    the number of declarations of assets as critical infrastructure assets that were made during the financial year by the Minister under section 51; and

  • (f)

    the number of annual reports given under section 30AG during the financial year; and

  • (g)

    the number of annual reports given under section 30AG during the financial year that included a statement to the effect that a critical infrastructure risk management program was up to date at the end of the financial year; and

  • (gaa)

    the number of directions given to entities under section 30AI during the financial year; and

  • (ga)

    the number of annual reports given under section 30AQ during the financial year; and

  • (h)

    the number of cyber security incidents reported during the financial year under section 30BC; and

  • (i)

    the number of cyber security incidents reported during the financial year under 30BD; and

  • (j)

    the number of notices given to entities under section 30CB during the financial year; and

  • (k)

    the number of notices given to entities under section 30CM during the financial year; and

  • (l)

    the number of notices given to entities under section 30CU during the financial year; and

  • (m)

    the number of notices given to entities under Division 5 of Part 2C during the financial year; and

  • (n)

    the number of Ministerial authorisations given under section 35AB during the financial year; and

  • (o)

    the number of Ministerial authorisations given under paragraph 35AB(2)(a) or (b) during the financial year; and

  • (p)

    the number of Ministerial authorisations given under paragraph 35AB(2)(c) or (d) during the financial year; and

  • (q)

    the number of Ministerial authorisations given under paragraph 35AB(2)(e) or (f) during the financial year; and

  • (r)

    the number of declarations of assets as systems of national significance that were made under section 52B during the financial year.

• (3)

  A report under subsection (1) must not include personal information (within the meaning of the Privacy Act 1988).

  Note: See also section 34C of the Acts Interpretation Act 1901, which contains extra rules about periodic reports.