112Directions

112 Directions

Directions in situations of urgency (1) The Commissioner may give a data scheme entity a written direction requiring the entity to take, or not to take, specified actions if the Commissioner is satisfied that: (a) either of the following situations exists: (i) the entity, or another entity, has acted or is likely to act in a way that is inconsistent with this Act or a data sharing agreement; (ii) an emergency or high risk situation has arisen or is likely to arise; and (b) for a requirement to take specified actions—it is necessary, to address the situation or prevent it arising again, for the entity to take the actions immediately or as soon as practicable; and (c) for a requirement not to take specified actions—the entity is taking the actions or may take them imminently and it is necessary, to address the situation or prevent it arising again, for the entity not to take the actions. Directions in other situations (2) The Commissioner may give a data scheme entity a written direction requiring the entity to take, or not to take, specified actions if the Commissioner is satisfied that: (a) the entity, or another entity, has acted or is likely to act in a way that is inconsistent with this Act or a data sharing agreement; and (b) for a requirement to take specified actions—it is necessary, to address the situation mentioned in paragraph (a) or prevent it arising again, for the entity to take the actions; and (c) for a requirement not to take specified actions—the entity is taking the actions or may take them and it is necessary, to address the situation mentioned in paragraph (a) or prevent it arising again, for the entity not to take the actions. (3) The Commissioner may give an accredited entity a written direction requiring the entity to take, or not to take, specified actions if the Commissioner is satisfied that: (a) the accreditation authority for the entity intends to cancel the entity’s accreditation (whether at the entity’s request or otherwise); and (b) for a requirement to take specified actions—it is necessary, to ensure that the entity does not hold scheme data after the cancellation, for the entity to take the actions; and (c) for a requirement not to take specified actions—it is necessary, to ensure that the entity does not hold scheme data after the cancellation, for the entity not to take the actions. Specified actions (4) The specified actions may include providing another entity with access to scheme data. Compliance with directions (5) An entity must comply with a direction given to the entity.

Civil penalty: 300 penalty units.

(6) A direction made under subsection (1), (2) or (3) is not a legislative instrument.