A relevant entity (other than the Commonwealth) for a critical infrastructure asset may make a record of, use or disclose protected information if the entity makes the record, or uses or discloses the information: