74Accreditation

74 Accreditation

(1) If an entity applies for accreditation as an ADSP or an accredited user under section 76, the accreditation authority for the entity may grant the entity the accreditation applied for if: (a) the entity is an Australian entity and not an excluded entity; and (b) the authority is satisfied that the entity meets the criteria for accreditation under section 77, to a standard appropriate for the accreditation; and (c) the authority considers it appropriate, in all the circumstances, to grant the accreditation. (2) If the accreditation authority grants the entity the accreditation applied for, the authority may accredit the entity: (a) without imposing conditions of accreditation; or (b) with conditions of accreditation imposed by the authority, if the authority is satisfied that imposing the conditions is: (i) appropriate for reasons of security, including on the basis of an adverse or qualified security assessment in respect of a person; or (ii) otherwise reasonable and appropriate in the circumstances to ensure that scheme data is collected and used in accordance with this Act.

Note 1: The accreditation authority must give the entity notice before making a decision to grant accreditation with conditions (see section 79).

Note 2: Even if the accreditation authority does not impose conditions of accreditation, conditions of accreditation prescribed by the rules may still be applicable to the entity.

(3) Without limiting paragraph (1)(b), the accreditation authority may be satisfied that the entity meets the criteria for accreditation under section 77 to the appropriate standard on the basis that: (a) the entity will comply with conditions of accreditation imposed on the entity; or (b) because the entity will comply with conditions of accreditation imposed on the entity, the entity does not need to meet one or more of the criteria. (4) For the purposes of paragraph (1)(c), an example of when the accreditation authority for an entity may consider it not appropriate to accredit the entity is if the authority considers that the entity’s participation in the data sharing scheme would pose concerns for reasons of security.