128Digital ID Regulator’s power to give directions to protect the integrity or performance of the Australian Government Digital ID System

128 Digital ID Regulator’s power to give directions to protect the integrity or performance of the Australian Government Digital ID System

(1) The Digital ID Regulator may give a direction to the following entities if the Digital ID Regulator considers it necessary to do so to protect the integrity or performance of the Australian Government Digital ID System: (a) accredited entities; (b) entities whose accreditation as an accredited entity is suspended. (2) Without limiting subsection (1), the Digital ID Regulator may give a direction to do one or more of the following: (a) conduct a privacy impact assessment in relation to a specified matter and provide a copy of the assessment to the Digital ID Regulator; (b) conduct a fraud assessment in relation to a specified matter and provide a copy of the report to the Digital ID Regulator in relation to the assessment; (c) conduct a security assessment in relation to a specified matter and provide a copy of the report to the Digital ID Regulator in relation to the assessment; (d) an act or thing specified by the Digital ID Rules. (3) If Accreditation Rules made for the purposes of section 28 prescribe requirements in relation to the conduct of an assessment mentioned in subsection (2), the assessment must comply with the requirements. (4) The direction must: (a) be in writing; and (b) specify the reason for the direction. (5) An entity must comply with a direction given under subsection (1).

Civil penalty: 1,000 penalty units.

(6) A direction under subsection (1) is not a legislative instrument.