Gathering and using information Part 4 Use and disclosure of protected information Division 3 Section 45 Subdivision B—Offence for unauthorised use or disclosure 45 Offence for unauthorised use or disclosure of protected information (1) An entity commits an offence if: (a) the entity obtains information; and (b) the information is protected information; and (c) the entity makes a record of, discloses or otherwise uses the information; and (d) the making of the record, or the disclosure or use, is not authorised under Subdivision A or required by subsection 51(3) or 52(4). Note 1: For exceptions to this offence, see section 46. Note 2: Information includes the fact that an asset is declared under section 51 to be a critical infrastructure asset (see the definition of protected information in section 5). Note 3: If the entity is not a legal person, see Division 2 of Part 7. Penalty: Imprisonment for 2 years or 120 penalty units, or both. (2) Section 15.1 of the Criminal Code (extended geographical jurisdiction—category A) applies to an offence against subsection (1). 46 Exceptions to offence for unauthorised use or disclosure Required or authorised by law (1) Section 45 does not apply if the making of the record, or the disclosure or use, of the information is required or authorised by or under: (a) a law of the Commonwealth, other than Subdivision A or subsection 51(3) or 52(4); or (b) a law of a State or Territory prescribed by the rules. (2) For the purposes of subsection (1) of this section, the following laws: No. 29, 2018 Security of Critical Infrastructure Act 2018 Authorised Version C2018A00029 41