78 Imposition, variation or removal of conditions of accreditation by accreditation authority
(1) The accreditation authority for an entity may, while the entity is an accredited entity, impose conditions of accreditation on the entity if the authority considers that doing so is:
(a) appropriate for reasons of security, including on the basis of an adverse or qualified security assessment in respect of a person; or
(b) otherwise reasonable and appropriate in the circumstances to ensure that scheme data is collected and used in accordance with this Act.
(2) If a court finds that an accredited entity has committed an offence against this Act, or a civil penalty order is made against an accredited entity for a contravention of subsection 14A(1) to which subsection 14A(2) applies, the accreditation authority for the entity must consider whether it is appropriate to:
(a) cancel or suspend the entity’s accreditation; or
(b) impose one or more conditions on the entity:
(i) to mitigate the risks of the entity contravening subsection 14A(1) again or otherwise breaching this Act; or
(ii) to prevent one or more individuals engaging in conduct in relation to scheme data held by the entity.
(3) If a civil penalty order is made against an entity that is accredited as both an ADSP and an accredited user, subsection (2) applies in relation to the entity in both capacities.
(4) The accreditation authority may vary or remove a condition of accreditation imposed on the entity by the authority at any time if the authority considers that doing so is:
(a) appropriate for reasons of security, including on the basis of an adverse or qualified security assessment in respect of a person; or
(b) otherwise appropriate in the circumstances.
(5) If the Minister decides to impose a condition of accreditation on an entity, or vary or remove such a condition, the Minister must notify the Commissioner of the decision.