A relevant entity for a critical infrastructure asset may make a record of, use or disclose protected information if: