Some progress but with some notable weaknesses (a state institution determines whether public disclosure is appropriate).
Seems more than reasonable given that the law does not appear to exclude state institutions from being the target of hacking. If that provision did not exist you can bet the law would never apply to any security sensitive sector.
„Oh yeah, he is very sensitive in this regard. Please don’t Talk to him about his insecurities“